@lmzhen/dsh-evolution-merge 0.30.2 → 0.30.4

package/lib/index.js

@@ -1,7 +1,7 @@
-import { join } from "node:path";
+import { join, resolve, sep } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { pairKeyOf, screen, selectCandidates, toEngineCandidate } from "@lmzhen/dsh-evolution-merge-engine";
-import { DEFAULT_SKILL_LIMITS, authorityFrom, contentHash, createSubagentChannel, evolutionHome, evolutionIoAdapter, executeUnitUndo, isPresent, newRunRegistry, newSkillLibrary, parseFrontmatter, planUnitUndoAcross, policyStageLimits, probeAbsent, probeList, probePresent, probeText, probeUnknown, scanContentThreats, supportRefs, transactIo, validateFrontmatter, validateSupportPath } from "@lmzhen/dsh-evolution-core";
+import { DEFAULT_SKILL_LIMITS, authorityFrom, contentHash, createSubagentChannel, evolutionHome, evolutionIoAdapter, executeUnitUndo, isPresent, newRunRegistry, newSkillLibrary, parseFrontmatter, planUnitUndoAcross, policyStageLimits, probeAbsent, probeList, probePresent, probeText, probeUnknown, scanContentThreats, skillsRoot, supportRefs, transactIo, validateFrontmatter, validateSupportPath } from "@lmzhen/dsh-evolution-core";
 import { HOST_ROUTES, json, methodNotAllowed, registerHostRoutes } from "@lmzhen/dsh-evolution-core/http-routes";
 import { createHash } from "node:crypto";
 //#region lib/types/adapters/select.js
@@ -356,7 +356,7 @@ async function upsertRow(io, home, now, row, expect = "any") {
 				current
 			}
 		};
-		if (current === void 0 && expect !== "any" && expect !== "absent") return {
+		if (current === void 0 && expect !== "any" && expect !== "absent" && expect !== "verify") return {
 			rows,
 			result: {
 				ok: false,
@@ -588,6 +588,7 @@ function recoveryFor(journal) {
 		case "committed":
 		case "rolled-back":
 		case "failed": return "none";
+		default: return "refuse";
 	}
 }
 //#endregion
@@ -607,7 +608,16 @@ async function writeJournal(io, home, journal) {
 function snapshotPath(home, runId) {
 	return join(home, "merge", "snapshots", runId.replace(/[^A-Za-z0-9_-]+/g, "_") + ".json");
 }
-async function writeCommitSnapshot(io, home, runId, plan, now) {
+async function writeCommitSnapshot(io, home, runId, plan, now, port) {
+	if (!isSafeSkillName(plan.target) || plan.sources.some((name) => !isSafeSkillName(name))) throw new Error("unsafe skill name in commit plan: " + plan.target);
+	const readSupport = port?.readSupportFiles === void 0 ? void 0 : (name) => port.readSupportFiles?.(name) ?? Promise.resolve([]);
+	const targetSupport = readSupport === void 0 || !plan.targetExists ? [] : await readSupport(plan.target);
+	const sourceSupport = [];
+	if (readSupport !== void 0) for (const name of plan.sources) for (const file of await readSupport(name)) sourceSupport.push({
+		name,
+		path: file.path,
+		content: file.content
+	});
 	const snapshot = {
 		runId,
 		target: plan.target,
@@ -618,6 +628,9 @@ async function writeCommitSnapshot(io, home, runId, plan, now) {
 			name: item.name,
 			body: item.body
 		})),
+		...targetSupport.length === 0 ? {} : { targetSupport },
+		...plan.supportFiles.length === 0 ? {} : { targetSupportAfter: plan.supportFiles },
+		...sourceSupport.length === 0 ? {} : { sourceSupport },
 		at: new Date(now).toISOString()
 	};
 	await io.writeText(snapshotPath(home, runId), JSON.stringify(snapshot, null, 2));
@@ -632,58 +645,22 @@ async function readCommitSnapshot(io, home, runId) {
 		return null;
 	}
 }
-function skillBodyPath(home, name) {
-	return join(home, "skills", name, "SKILL.md");
-}
-//#endregion
-//#region lib/types/commit-recovery.js
-/** Startup replay for non-terminal commit journals. */
-async function recoverCommitJournals(io, home, now) {
-	const dir = join(home, "merge", "journals");
-	if (!await io.exists(dir)) return [];
-	const files = (await io.list(dir)).filter((name) => name.endsWith(".json"));
-	const reports = [];
-	for (const file of files) {
-		let journal;
-		try {
-			journal = JSON.parse(await io.readText(join(dir, file)) ?? "");
-		} catch {
-			continue;
-		}
-		const recovery = recoveryFor(journal);
-		if (recovery === "none") continue;
-		const snapshot = await readCommitSnapshot(io, home, journal.runId);
-		let action = "report-only";
-		let ok = true;
-		if (recovery === "retry-commit") action = "no-host-write";
-		else if (snapshot === null) {
-			action = "snapshot-missing";
-			ok = false;
-		} else try {
-			if (recovery === "rollback-sources") for (const source of snapshot.sourceBodies) await io.writeText(skillBodyPath(home, source.name), source.body);
-			if (snapshot.create && snapshot.targetBody === null) try {
-				await io.remove(skillBodyPath(home, snapshot.target));
-			} catch {}
-			else if (snapshot.targetBody !== null) await io.writeText(skillBodyPath(home, snapshot.target), snapshot.targetBody);
-			action = recovery === "rollback-sources" ? "restored-sources-and-target" : "restored-target";
-		} catch (error) {
-			action = "restore-failed: " + (error instanceof Error ? error.message : String(error));
-			ok = false;
-		}
-		await writeJournal(io, home, {
-			...journal,
-			phase: ok ? "rolled-back" : "failed",
-			updatedAt: new Date(now).toISOString()
-		});
-		reports.push({
-			runId: journal.runId,
-			phase: journal.phase,
-			action,
-			ok
-		});
-	}
-	await io.writeText(join(home, "merge", "recovery.json"), JSON.stringify(reports, null, 2));
-	return reports;
+function isSafeSkillName(name) {
+	return /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name) && name !== "." && name !== "..";
+}
+function skillFilePath(root, name, path) {
+	if (!isSafeSkillName(name) || path.startsWith("/") || path.split("/").includes("..")) throw new Error("unsafe skill file: " + name + "/" + path);
+	const base = resolve(root, name);
+	const file = resolve(base, path);
+	if (!file.startsWith(base + sep)) throw new Error("skill file escapes skill: " + name + "/" + path);
+	return file;
+}
+function skillBodyPath(root, name) {
+	if (!isSafeSkillName(name)) throw new Error("unsafe skill name: " + name);
+	const base = resolve(root);
+	const path = resolve(base, name, "SKILL.md");
+	if (!path.startsWith(base + sep)) throw new Error("skill path escapes root: " + name);
+	return path;
 }
 //#endregion
 //#region lib/types/commit-receipt.js
@@ -761,6 +738,113 @@ async function readCommitReceipt(io, home, runId, target) {
 	return null;
 }
 //#endregion
+//#region lib/types/commit-recovery.js
+/** Startup replay for non-terminal commit journals. */
+async function recoverCommitJournals(io, home, now, skillRoot, restoreSource, isActive) {
+	const dir = join(home, "merge", "journals");
+	if (!await io.exists(dir)) return [];
+	const files = (await io.list(dir)).filter((name) => name.endsWith(".json"));
+	const reports = [];
+	for (const file of files) {
+		let journal;
+		try {
+			journal = JSON.parse(await io.readText(join(dir, file)) ?? "");
+		} catch {
+			continue;
+		}
+		if (isActive?.(journal.runId) === true) {
+			reports.push({
+				runId: journal.runId,
+				phase: journal.phase,
+				action: "skipped-active-run",
+				ok: true
+			});
+			continue;
+		}
+		const recovery = recoveryFor(journal);
+		if (recovery === "none") continue;
+		if (recovery === "refuse") {
+			reports.push({
+				runId: journal.runId,
+				phase: journal.phase,
+				action: "unknown-phase-refused",
+				ok: false
+			});
+			continue;
+		}
+		let receipt = null;
+		try {
+			receipt = await readCommitReceipt(io, home, journal.runId, journal.target);
+		} catch {
+			reports.push({
+				runId: journal.runId,
+				phase: journal.phase,
+				action: "receipt-read-failed",
+				ok: false
+			});
+			continue;
+		}
+		if (receipt !== null) {
+			await writeJournal(io, home, {
+				...journal,
+				phase: "committed",
+				unitId: receipt.unitId,
+				updatedAt: new Date(now).toISOString()
+			});
+			reports.push({
+				runId: journal.runId,
+				phase: journal.phase,
+				action: "receipt-committed",
+				ok: true
+			});
+			continue;
+		}
+		const snapshot = await readCommitSnapshot(io, home, journal.runId);
+		let action = "report-only";
+		let ok = true;
+		if (recovery === "retry-commit") action = "no-host-write";
+		else if (snapshot === null) {
+			action = "snapshot-missing";
+			ok = false;
+		} else try {
+			if (recovery === "rollback-sources") {
+				let restoredArchived = restoreSource !== void 0;
+				if (restoreSource !== void 0) {
+					for (const source of snapshot.sourceBodies) if (!await restoreSource(source.name)) restoredArchived = false;
+				}
+				if (!restoredArchived) for (const source of snapshot.sourceBodies) await io.writeText(skillBodyPath(skillRoot, source.name), source.body);
+			}
+			if (snapshot.create && snapshot.targetBody === null) try {
+				await io.remove(skillBodyPath(skillRoot, snapshot.target));
+			} catch {}
+			else if (snapshot.targetBody !== null) await io.writeText(skillBodyPath(skillRoot, snapshot.target), snapshot.targetBody);
+			const oldPaths = new Set((snapshot.targetSupport ?? []).map((file) => file.path));
+			for (const file of snapshot.targetSupport ?? []) await io.writeText(skillFilePath(skillRoot, snapshot.target, file.path), file.content);
+			for (const file of snapshot.targetSupportAfter ?? []) if (!oldPaths.has(file.path)) try {
+				await io.remove(skillFilePath(skillRoot, snapshot.target, file.path));
+			} catch {}
+			for (const file of snapshot.sourceSupport ?? []) await io.writeText(skillFilePath(skillRoot, file.name, file.path), file.content);
+			action = recovery === "rollback-sources" ? "restored-sources-and-target" : "restored-target";
+		} catch (error) {
+			action = "restore-failed: " + (error instanceof Error ? error.message : String(error));
+			ok = false;
+		}
+		if (ok) await writeJournal(io, home, {
+			...journal,
+			phase: "rolled-back",
+			updatedAt: new Date(now).toISOString()
+		});
+		reports.push({
+			runId: journal.runId,
+			phase: journal.phase,
+			action,
+			ok
+		});
+	}
+	await io.writeText(join(home, "merge", "recovery.json"), JSON.stringify(reports, null, 2));
+	return reports;
+}
+//#endregion
 //#region lib/types/coordinator.js
 /**
 * Pure merge transition table. No io, no run shell, no subagents.
@@ -866,11 +950,15 @@ function transition(current, event) {
 			return event.approval === "on" ? next(current, event.at, "pending", {
 				...event.decision === void 0 ? {} : { decision: event.decision },
 				...event.stagingRef === void 0 ? {} : { stagingRef: event.stagingRef },
-				...event.stagingExpiresAt === void 0 ? {} : { stagingExpiresAt: event.stagingExpiresAt }
+				...event.stagingExpiresAt === void 0 ? {} : { stagingExpiresAt: event.stagingExpiresAt },
+				...event.sourceRevision === void 0 ? {} : { sourceRevision: event.sourceRevision },
+				...event.targetRevision === void 0 ? {} : { targetRevision: event.targetRevision }
 			}) : next(current, event.at, "approved", {
 				...event.decision === void 0 ? {} : { decision: event.decision },
 				...event.stagingRef === void 0 ? {} : { stagingRef: event.stagingRef },
-				...event.stagingExpiresAt === void 0 ? {} : { stagingExpiresAt: event.stagingExpiresAt }
+				...event.stagingExpiresAt === void 0 ? {} : { stagingExpiresAt: event.stagingExpiresAt },
+				...event.sourceRevision === void 0 ? {} : { sourceRevision: event.sourceRevision },
+				...event.targetRevision === void 0 ? {} : { targetRevision: event.targetRevision }
 			});
 		case "round1-fail": return current.state === "verify" ? next(current, event.at, "verify", {
 			failure: event.failure,
@@ -1678,7 +1766,8 @@ async function runScan(options) {
 			});
 			if (!created.ok || created.row === null) throw new Error(created.ok ? "candidate row missing" : created.message);
 			row = created.row;
-			await upsertRow(options.io, options.home, options.now, row);
+			const placed = await upsertRow(options.io, options.home, options.now, row, "verify");
+			if (!placed.ok) throw new Error("pair already in " + placed.current.state);
 		} catch (error) {
 			totals.failed += 1;
 			pairs.push({
@@ -3049,7 +3138,7 @@ async function commitStagedRun(io, home, runId, port, options) {
 		message: assembled.message
 	};
 	try {
-		await writeCommitSnapshot(io, home, runId, assembled.plan, options.now());
+		await writeCommitSnapshot(io, home, runId, assembled.plan, options.now(), port);
 	} catch (error) {
 		return {
 			ok: false,
@@ -3073,6 +3162,7 @@ async function commitStagedRun(io, home, runId, port, options) {
 		try {
 			await writeJournal(io, home, {
 				...journal,
+				phase: "failed",
 				updatedAt: new Date(options.now()).toISOString()
 			});
 		} catch {}
@@ -3082,6 +3172,14 @@ async function commitStagedRun(io, home, runId, port, options) {
 			plan: assembled.plan
 		};
 	}
+	const committed = {
+		...journal,
+		phase: "committed",
+		updatedAt: new Date(options.now()).toISOString()
+	};
+	try {
+		await writeJournal(io, home, committed);
+	} catch {}
 	if (result.unitId === void 0) return {
 		ok: true,
 		plan: assembled.plan,
@@ -3101,14 +3199,6 @@ async function commitStagedRun(io, home, runId, port, options) {
 	};
 	try {
 		await writeCommitReceipt(io, home, receipt);
-		try {
-			await writeJournal(io, home, {
-				...journal,
-				unitId: result.unitId,
-				phase: "committed",
-				updatedAt: new Date(options.now()).toISOString()
-			});
-		} catch {}
 		return {
 			ok: true,
 			plan: assembled.plan,
@@ -3504,7 +3594,21 @@ function skillLibraryPort(skills) {
 			const names = await archivedNames.call(skills);
 			return names === null ? true : names.includes(name);
 		},
-		commitMerge: (plan) => skills.commitMerge(plan)
+		commitMerge: (plan) => skills.commitMerge(plan),
+		async readSupportFiles(name) {
+			if (typeof skills.listSupportFiles !== "function") return [];
+			const probe = await skills.listSupportFiles(name);
+			if (probe.kind === "unknown") throw new Error("support file list unknown: " + name);
+			if (probe.kind === "absent") return [];
+			return await Promise.all(probe.value.map(async (path) => {
+				const content = await skills.readSupportFile(name, path);
+				if (content === null) throw new Error("support file disappeared: " + name + "/" + path);
+				return {
+					path,
+					content
+				};
+			}));
+		}
 	};
 }
 //#endregion
@@ -3561,6 +3665,7 @@ function createMergeRuntime(deps) {
 				b: command.b
 			}];
 			const existing = (await loadMergeState(deps.io, deps.home)).state.rows.find((row) => row.pairKey === pairKey(command.a, command.b));
+			if (existing?.state === "skipped") await dropRow(deps.io, deps.home, deps.now, existing.id);
 			if (existing?.state === "pending") return {
 				ok: false,
 				text: "该 pair 已在待批准队列，先 approve/reject/discard: " + existing.id
@@ -3624,7 +3729,7 @@ function createMergeRuntime(deps) {
 			const managed = new Set(cards.filter((card) => card.managed === true).map((card) => card.name));
 			const loadedState = await loadMergeState(deps.io, deps.home);
 			const skipped = skippedPairKeys(loadedState.state.rows, deps.params.mergeSkippedTtlDays, deps.now());
-			const held = new Set(loadedState.state.rows.filter((row) => row.queue === "pending" || !canRetry(row)).map((row) => row.pairKey));
+			const held = new Set(loadedState.state.rows.filter((row) => row.queue === "pending" || row.queue === "fuse" || !canRetry(row)).map((row) => row.pairKey));
 			const conflictNotes = loadedState.state.rows.filter((row) => row.state === "pending" || row.state === "approved" || row.state === "fuse" || row.state === "skipped").map((row) => "conflict:" + row.state + ":" + row.pairKey + ":" + row.id);
 			const result = await runScanCommand({
 				...common,
@@ -4404,11 +4509,6 @@ function apply(ctx, rawConfig = {}) {
 		loadMergeState(io, home).then((loaded) => cleanupExpiredStaging(io, home, Date.now(), new Set(loaded.state.rows.map((row) => row.runId).filter((id) => id !== void 0)))).catch((error) => {
 			ctx.logger.warn("merge staging cleanup failed: " + (error instanceof Error ? error.message : String(error)));
 		});
-		recoverCommitJournals(io, home, Date.now()).then((reports) => {
-			if (reports.length > 0) ctx.logger.info("merge commit recovery: " + reports.map((report) => report.runId + "=" + report.action).join(", "));
-		}).catch((error) => {
-			ctx.logger.warn("merge commit recovery failed: " + (error instanceof Error ? error.message : String(error)));
-		});
 		const runs = newRunRegistry({
 			io,
 			home,
@@ -4434,6 +4534,17 @@ function apply(ctx, rawConfig = {}) {
 				...policyStageLimits(policySnapshot?.get?.())
 			}
 		});
+		const mergeSkillsRoot = skills.root ?? skillsRoot();
+		recoverCommitJournals(io, home, Date.now(), mergeSkillsRoot, async (name) => {
+			return (await skills.restoreFromArchive(name)).ok;
+		}, (runId) => {
+			const run = runs.find(runId);
+			return run !== void 0 && run.state === "running";
+		}).then((reports) => {
+			if (reports.length > 0) ctx.logger.info("merge commit recovery: " + reports.map((report) => report.runId + "=" + report.action).join(", "));
+		}).catch((error) => {
+			ctx.logger.warn("merge commit recovery failed: " + (error instanceof Error ? error.message : String(error)));
+		});
 		const channel = subagentChannelAdapter(createSubagentChannel(ctx));
 		const stage = new StageToolRegistry();
 		const engineConfig = engineConfigFromEnv(params.mergeModelsRoot);

package/lib/types/adapters/library.js

@@ -9,6 +9,21 @@ export function skillLibraryPort(skills) {
             return names === null ? true : names.includes(name);
         },
         commitMerge: plan => skills.commitMerge(plan),
+        async readSupportFiles(name) {
+            if (typeof skills.listSupportFiles !== 'function')
+                return [];
+            const probe = await skills.listSupportFiles(name);
+            if (probe.kind === 'unknown')
+                throw new Error('support file list unknown: ' + name);
+            if (probe.kind === 'absent')
+                return [];
+            return await Promise.all(probe.value.map(async (path) => {
+                const content = await skills.readSupportFile(name, path);
+                if (content === null)
+                    throw new Error('support file disappeared: ' + name + '/' + path);
+                return { path, content };
+            }));
+        },
     };
 }
 //# sourceMappingURL=library.js.map

package/lib/types/commit-execute.d.ts

@@ -8,6 +8,10 @@ import { type CommitAssemblyPort } from './commit-assembly.ts';
 import { type CommitReceipt } from './commit-receipt.ts';
 export interface CommitPort extends CommitAssemblyPort {
     commitMerge(plan: CommitMergePlan): Promise<CommitMergeResult>;
+    readSupportFiles?(name: string): Promise<readonly {
+        readonly path: string;
+        readonly content: string;
+    }[]>;
 }
 export interface CommitStagedOptions {
     readonly origin: CommitMergePlan['origin'];

package/lib/types/commit-execute.js

@@ -8,7 +8,7 @@ export async function commitStagedRun(io, home, runId, port, options) {
     if (!assembled.ok)
         return { ok: false, message: assembled.message };
     try {
-        await writeCommitSnapshot(io, home, runId, assembled.plan, options.now());
+        await writeCommitSnapshot(io, home, runId, assembled.plan, options.now(), port);
     }
     catch (error) {
         return { ok: false, message: 'commit snapshot failed; refusing to write: ' + (error instanceof Error ? error.message : String(error)), plan: assembled.plan };
@@ -21,11 +21,16 @@ export async function commitStagedRun(io, home, runId, port, options) {
     const result = await port.commitMerge(assembled.plan);
     if (!result.ok) {
         try {
-            await writeJournal(io, home, { ...journal, updatedAt: new Date(options.now()).toISOString() });
+            await writeJournal(io, home, { ...journal, phase: 'failed', updatedAt: new Date(options.now()).toISOString() });
         }
         catch { }
         return { ok: false, message: result.message, plan: assembled.plan };
     }
+    const committed = { ...journal, phase: 'committed', updatedAt: new Date(options.now()).toISOString() };
+    try {
+        await writeJournal(io, home, committed);
+    }
+    catch { }
     if (result.unitId === undefined)
         return { ok: true, plan: assembled.plan, result, warning: 'commit landed without a unitId; receipt not written' };
     const receipt = {
@@ -41,10 +46,6 @@ export async function commitStagedRun(io, home, runId, port, options) {
     };
     try {
         await writeCommitReceipt(io, home, receipt);
-        try {
-            await writeJournal(io, home, { ...journal, unitId: result.unitId, phase: 'committed', updatedAt: new Date(options.now()).toISOString() });
-        }
-        catch { }
         return { ok: true, plan: assembled.plan, result, receipt };
     }
     catch (error) {

package/lib/types/commit-recovery.d.ts

@@ -6,5 +6,5 @@ export interface CommitRecoveryReport {
     readonly action: string;
     readonly ok: boolean;
 }
-export declare function recoverCommitJournals(io: EvolutionIoLike, home: string, now: number): Promise<readonly CommitRecoveryReport[]>;
+export declare function recoverCommitJournals(io: EvolutionIoLike, home: string, now: number, skillRoot: string, restoreSource?: (name: string) => Promise<boolean>, isActive?: (runId: string) => boolean): Promise<readonly CommitRecoveryReport[]>;
 //# sourceMappingURL=commit-recovery.d.ts.map

package/lib/types/commit-recovery.js

@@ -2,8 +2,9 @@
 import { join } from 'node:path';
 import { recoveryFor } from "./domain/commit-journal.js";
 import { writeJournal } from "./domain/commit-journal-store.js";
-import { readCommitSnapshot, skillBodyPath } from "./commit-snapshot.js";
-export async function recoverCommitJournals(io, home, now) {
+import { readCommitSnapshot, skillBodyPath, skillFilePath } from "./commit-snapshot.js";
+import { readCommitReceipt } from "./commit-receipt.js";
+export async function recoverCommitJournals(io, home, now, skillRoot, restoreSource, isActive) {
     const dir = join(home, 'merge', 'journals');
     if (!(await io.exists(dir)))
         return [];
@@ -17,9 +18,30 @@ export async function recoverCommitJournals(io, home, now) {
         catch {
             continue;
         }
+        if (isActive?.(journal.runId) === true) {
+            reports.push({ runId: journal.runId, phase: journal.phase, action: 'skipped-active-run', ok: true });
+            continue;
+        }
         const recovery = recoveryFor(journal);
         if (recovery === 'none')
             continue;
+        if (recovery === 'refuse') {
+            reports.push({ runId: journal.runId, phase: journal.phase, action: 'unknown-phase-refused', ok: false });
+            continue;
+        }
+        let receipt = null;
+        try {
+            receipt = await readCommitReceipt(io, home, journal.runId, journal.target);
+        }
+        catch {
+            reports.push({ runId: journal.runId, phase: journal.phase, action: 'receipt-read-failed', ok: false });
+            continue;
+        }
+        if (receipt !== null) {
+            await writeJournal(io, home, { ...journal, phase: 'committed', unitId: receipt.unitId, updatedAt: new Date(now).toISOString() });
+            reports.push({ runId: journal.runId, phase: journal.phase, action: 'receipt-committed', ok: true });
+            continue;
+        }
         const snapshot = await readCommitSnapshot(io, home, journal.runId);
         let action = 'report-only';
         let ok = true;
@@ -33,18 +55,41 @@ export async function recoverCommitJournals(io, home, now) {
         else {
             try {
                 if (recovery === 'rollback-sources') {
-                    for (const source of snapshot.sourceBodies)
-                        await io.writeText(skillBodyPath(home, source.name), source.body);
+                    let restoredArchived = restoreSource !== undefined;
+                    if (restoreSource !== undefined) {
+                        for (const source of snapshot.sourceBodies) {
+                            if (!(await restoreSource(source.name)))
+                                restoredArchived = false;
+                        }
+                    }
+                    if (!restoredArchived) {
+                        for (const source of snapshot.sourceBodies)
+                            await io.writeText(skillBodyPath(skillRoot, source.name), source.body);
+                    }
                 }
                 if (snapshot.create && snapshot.targetBody === null) {
                     try {
-                        await io.remove(skillBodyPath(home, snapshot.target));
+                        await io.remove(skillBodyPath(skillRoot, snapshot.target));
                     }
                     catch { /* already gone */ }
                 }
                 else if (snapshot.targetBody !== null) {
-                    await io.writeText(skillBodyPath(home, snapshot.target), snapshot.targetBody);
+                    await io.writeText(skillBodyPath(skillRoot, snapshot.target), snapshot.targetBody);
+                }
+                const oldPaths = new Set((snapshot.targetSupport ?? []).map(file => file.path));
+                for (const file of snapshot.targetSupport ?? []) {
+                    await io.writeText(skillFilePath(skillRoot, snapshot.target, file.path), file.content);
+                }
+                for (const file of snapshot.targetSupportAfter ?? []) {
+                    if (!oldPaths.has(file.path)) {
+                        try {
+                            await io.remove(skillFilePath(skillRoot, snapshot.target, file.path));
+                        }
+                        catch { /* already gone */ }
+                    }
                 }
+                for (const file of snapshot.sourceSupport ?? [])
+                    await io.writeText(skillFilePath(skillRoot, file.name, file.path), file.content);
                 action = recovery === 'rollback-sources' ? 'restored-sources-and-target' : 'restored-target';
             }
             catch (error) {
@@ -52,7 +97,8 @@ export async function recoverCommitJournals(io, home, now) {
                 ok = false;
             }
         }
-        await writeJournal(io, home, { ...journal, phase: ok ? 'rolled-back' : 'failed', updatedAt: new Date(now).toISOString() });
+        if (ok)
+            await writeJournal(io, home, { ...journal, phase: 'rolled-back', updatedAt: new Date(now).toISOString() });
         reports.push({ runId: journal.runId, phase: journal.phase, action, ok });
     }
     await io.writeText(join(home, 'merge', 'recovery.json'), JSON.stringify(reports, null, 2));

package/lib/types/commit-snapshot.d.ts

@@ -9,10 +9,30 @@ export interface CommitSnapshot {
         readonly name: string;
         readonly body: string;
     }[];
+    readonly targetSupport?: readonly {
+        readonly path: string;
+        readonly content: string;
+    }[];
+    readonly targetSupportAfter?: readonly {
+        readonly path: string;
+        readonly content: string;
+    }[];
+    readonly sourceSupport?: readonly {
+        readonly name: string;
+        readonly path: string;
+        readonly content: string;
+    }[];
     readonly at: string;
 }
 export declare function snapshotPath(home: string, runId: string): string;
-export declare function writeCommitSnapshot(io: EvolutionIoLike, home: string, runId: string, plan: CommitMergePlan, now: number): Promise<CommitSnapshot>;
+export declare function writeCommitSnapshot(io: EvolutionIoLike, home: string, runId: string, plan: CommitMergePlan, now: number, port?: {
+    readSupportFiles?(name: string): Promise<readonly {
+        readonly path: string;
+        readonly content: string;
+    }[]>;
+}): Promise<CommitSnapshot>;
 export declare function readCommitSnapshot(io: EvolutionIoLike, home: string, runId: string): Promise<CommitSnapshot | null>;
-export declare function skillBodyPath(home: string, name: string): string;
+export declare function isSafeSkillName(name: string): boolean;
+export declare function skillFilePath(root: string, name: string, path: string): string;
+export declare function skillBodyPath(root: string, name: string): string;
 //# sourceMappingURL=commit-snapshot.d.ts.map

package/lib/types/commit-snapshot.js

@@ -1,13 +1,30 @@
 /** Pre-commit snapshot: enough to restore the target and archived sources after a crash. */
-import { join } from 'node:path';
+import { join, resolve, sep } from 'node:path';
 export function snapshotPath(home, runId) {
     return join(home, 'merge', 'snapshots', runId.replace(/[^A-Za-z0-9_-]+/g, '_') + '.json');
 }
-export async function writeCommitSnapshot(io, home, runId, plan, now) {
+export async function writeCommitSnapshot(io, home, runId, plan, now, port) {
+    if (!isSafeSkillName(plan.target) || plan.sources.some(name => !isSafeSkillName(name))) {
+        throw new Error('unsafe skill name in commit plan: ' + plan.target);
+    }
+    const readSupport = port?.readSupportFiles === undefined
+        ? undefined
+        : (name) => port.readSupportFiles?.(name) ?? Promise.resolve([]);
+    const targetSupport = readSupport === undefined || !plan.targetExists ? [] : await readSupport(plan.target);
+    const sourceSupport = [];
+    if (readSupport !== undefined) {
+        for (const name of plan.sources) {
+            for (const file of await readSupport(name))
+                sourceSupport.push({ name, path: file.path, content: file.content });
+        }
+    }
     const snapshot = {
         runId, target: plan.target, create: !plan.targetExists, sources: plan.sources,
         targetBody: plan.expectedTargetBody,
         sourceBodies: plan.expectedSourceBodies.map(item => ({ name: item.name, body: item.body })),
+        ...(targetSupport.length === 0 ? {} : { targetSupport }),
+        ...(plan.supportFiles.length === 0 ? {} : { targetSupportAfter: plan.supportFiles }),
+        ...(sourceSupport.length === 0 ? {} : { sourceSupport }),
         at: new Date(now).toISOString(),
     };
     await io.writeText(snapshotPath(home, runId), JSON.stringify(snapshot, null, 2));
@@ -24,7 +41,25 @@ export async function readCommitSnapshot(io, home, runId) {
         return null;
     }
 }
-export function skillBodyPath(home, name) {
-    return join(home, 'skills', name, 'SKILL.md');
+export function isSafeSkillName(name) {
+    return /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name) && name !== '.' && name !== '..';
+}
+export function skillFilePath(root, name, path) {
+    if (!isSafeSkillName(name) || path.startsWith('/') || path.split('/').includes('..'))
+        throw new Error('unsafe skill file: ' + name + '/' + path);
+    const base = resolve(root, name);
+    const file = resolve(base, path);
+    if (!file.startsWith(base + sep))
+        throw new Error('skill file escapes skill: ' + name + '/' + path);
+    return file;
+}
+export function skillBodyPath(root, name) {
+    if (!isSafeSkillName(name))
+        throw new Error('unsafe skill name: ' + name);
+    const base = resolve(root);
+    const path = resolve(base, name, 'SKILL.md');
+    if (!path.startsWith(base + sep))
+        throw new Error('skill path escapes root: ' + name);
+    return path;
 }
 //# sourceMappingURL=commit-snapshot.js.map

package/lib/types/coordinator.d.ts

@@ -20,6 +20,8 @@ export type MergeEvent = {
     readonly decision?: MergeDecision;
     readonly stagingRef?: string;
     readonly stagingExpiresAt?: number;
+    readonly sourceRevision?: string;
+    readonly targetRevision?: string;
     readonly at: string;
 } | {
     readonly type: 'round1-fail';

package/lib/types/coordinator.js

@@ -98,8 +98,8 @@ export function transition(current, event) {
             if (current.state !== 'verify')
                 return invalid(event, current.state);
             return event.approval === 'on'
-                ? next(current, event.at, 'pending', { ...(event.decision === undefined ? {} : { decision: event.decision }), ...(event.stagingRef === undefined ? {} : { stagingRef: event.stagingRef }), ...(event.stagingExpiresAt === undefined ? {} : { stagingExpiresAt: event.stagingExpiresAt }) })
-                : next(current, event.at, 'approved', { ...(event.decision === undefined ? {} : { decision: event.decision }), ...(event.stagingRef === undefined ? {} : { stagingRef: event.stagingRef }), ...(event.stagingExpiresAt === undefined ? {} : { stagingExpiresAt: event.stagingExpiresAt }) });
+                ? next(current, event.at, 'pending', { ...(event.decision === undefined ? {} : { decision: event.decision }), ...(event.stagingRef === undefined ? {} : { stagingRef: event.stagingRef }), ...(event.stagingExpiresAt === undefined ? {} : { stagingExpiresAt: event.stagingExpiresAt }), ...(event.sourceRevision === undefined ? {} : { sourceRevision: event.sourceRevision }), ...(event.targetRevision === undefined ? {} : { targetRevision: event.targetRevision }) })
+                : next(current, event.at, 'approved', { ...(event.decision === undefined ? {} : { decision: event.decision }), ...(event.stagingRef === undefined ? {} : { stagingRef: event.stagingRef }), ...(event.stagingExpiresAt === undefined ? {} : { stagingExpiresAt: event.stagingExpiresAt }), ...(event.sourceRevision === undefined ? {} : { sourceRevision: event.sourceRevision }), ...(event.targetRevision === undefined ? {} : { targetRevision: event.targetRevision }) });
         case 'round1-fail':
             return current.state === 'verify'
                 ? next(current, event.at, 'verify', { failure: event.failure, attempts: (current.attempts ?? 0) + 1 })

package/lib/types/domain/commit-journal.d.ts

@@ -10,7 +10,7 @@ export interface CommitJournal {
     readonly updatedAt: string;
 }
 export declare function advanceJournal(journal: CommitJournal, phase: JournalPhase, at: string): CommitJournal;
-export type JournalRecovery = 'none' | 'retry-commit' | 'rollback-target' | 'rollback-sources';
+export type JournalRecovery = 'none' | 'retry-commit' | 'rollback-target' | 'rollback-sources' | 'refuse';
 /** What a restart may do with the last durable phase. */
 export declare function recoveryFor(journal: CommitJournal): JournalRecovery;
 //# sourceMappingURL=commit-journal.d.ts.map

package/lib/types/domain/commit-journal.js

@@ -20,6 +20,7 @@ export function recoveryFor(journal) {
         case 'committed':
         case 'rolled-back':
         case 'failed': return 'none';
+        default: return 'refuse';
     }
 }
 //# sourceMappingURL=commit-journal.js.map

package/lib/types/index.js

@@ -4,7 +4,7 @@ import { screen as engineScreen } from '@lmzhen/dsh-evolution-merge-engine';
 import { selectWithErrors } from "./adapters/select.js";
 import { createEngineScreening } from "./adapters/engine-screen.js";
 import { createEngineRunner } from "./adapters/model-runner.js";
-import { authorityFrom, createSubagentChannel, DEFAULT_SKILL_LIMITS, evolutionHome, evolutionIoAdapter, newRunRegistry, newSkillLibrary, policyStageLimits } from '@lmzhen/dsh-evolution-core';
+import { authorityFrom, createSubagentChannel, DEFAULT_SKILL_LIMITS, evolutionHome, evolutionIoAdapter, newRunRegistry, newSkillLibrary, policyStageLimits, skillsRoot } from '@lmzhen/dsh-evolution-core';
 import { registerHostRoutes } from '@lmzhen/dsh-evolution-core/http-routes';
 import { loadMergeState, upsertRow } from "./state.js";
 import { cleanupExpiredStaging } from "./staging.js";
@@ -122,8 +122,6 @@ export function apply(ctx, rawConfig = {}) {
         const io = evolutionIoAdapter(() => registry.provider());
         const home = evolutionHome();
         void loadMergeState(io, home).then(loaded => cleanupExpiredStaging(io, home, Date.now(), new Set(loaded.state.rows.map(row => row.runId).filter((id) => id !== undefined)))).catch((error) => { ctx.logger.warn('merge staging cleanup failed: ' + (error instanceof Error ? error.message : String(error))); });
-        void recoverCommitJournals(io, home, Date.now()).then((reports) => { if (reports.length > 0)
-            ctx.logger.info('merge commit recovery: ' + reports.map(report => report.runId + '=' + report.action).join(', ')); }).catch((error) => { ctx.logger.warn('merge commit recovery failed: ' + (error instanceof Error ? error.message : String(error))); });
         const runs = newRunRegistry({ io, home, warn: (message) => { ctx.logger.warn(message); } });
         void runs.load();
         ctx.effect(() => {
@@ -140,6 +138,15 @@ export function apply(ctx, rawConfig = {}) {
             io, ctx, authority: authorityFrom({ origin: 'subagent' }),
             limits: { ...DEFAULT_SKILL_LIMITS, ...policyStageLimits(policySnapshot?.get?.()) },
         });
+        const mergeSkillsRoot = skills.root ?? skillsRoot();
+        void recoverCommitJournals(io, home, Date.now(), mergeSkillsRoot, async (name) => {
+            const result = await skills.restoreFromArchive(name);
+            return result.ok;
+        }, (runId) => {
+            const run = runs.find(runId);
+            return run !== undefined && run.state === 'running';
+        }).then((reports) => { if (reports.length > 0)
+            ctx.logger.info('merge commit recovery: ' + reports.map(report => report.runId + '=' + report.action).join(', ')); }).catch((error) => { ctx.logger.warn('merge commit recovery failed: ' + (error instanceof Error ? error.message : String(error))); });
         const channel = subagentChannelAdapter(createSubagentChannel(ctx));
         const stage = new StageToolRegistry();
         const engineConfig = engineConfigFromEnv(params.mergeModelsRoot);

package/lib/types/runtime.js

@@ -55,6 +55,9 @@ export function createMergeRuntime(deps) {
                 }
                 const pair = [{ a: command.a, b: command.b }];
                 const existing = (await loadMergeState(deps.io, deps.home)).state.rows.find(row => row.pairKey === pairKey(command.a, command.b));
+                if (existing?.state === 'skipped') {
+                    await dropRow(deps.io, deps.home, deps.now, existing.id);
+                }
                 if (existing?.state === 'pending') {
                     return { ok: false, text: '该 pair 已在待批准队列，先 approve/reject/discard: ' + existing.id };
                 }
@@ -95,7 +98,7 @@ export function createMergeRuntime(deps) {
                 const managed = new Set(cards.filter(card => card.managed === true).map(card => card.name));
                 const loadedState = await loadMergeState(deps.io, deps.home);
                 const skipped = skippedPairKeys(loadedState.state.rows, deps.params.mergeSkippedTtlDays, deps.now());
-                const held = new Set(loadedState.state.rows.filter(row => row.queue === 'pending' || !canRetry(row)).map(row => row.pairKey));
+                const held = new Set(loadedState.state.rows.filter(row => row.queue === 'pending' || row.queue === 'fuse' || !canRetry(row)).map(row => row.pairKey));
                 const conflictNotes = loadedState.state.rows
                     .filter(row => row.state === 'pending' || row.state === 'approved' || row.state === 'fuse' || row.state === 'skipped')
                     .map(row => 'conflict:' + row.state + ':' + row.pairKey + ':' + row.id);

package/lib/types/scan-run.js

@@ -65,7 +65,9 @@ export async function runScan(options) {
             if (!created.ok || created.row === null)
                 throw new Error(created.ok ? 'candidate row missing' : created.message);
             row = created.row;
-            await upsertRow(options.io, options.home, options.now, row);
+            const placed = await upsertRow(options.io, options.home, options.now, row, 'verify');
+            if (!placed.ok)
+                throw new Error('pair already in ' + placed.current.state);
         }
         catch (error) {
             totals.failed += 1;

package/lib/types/state.js

@@ -62,7 +62,7 @@ export async function upsertRow(io, home, now, row, expect = 'any') {
         if (current !== undefined && expect !== 'any' && (expect === 'absent' || queueOf(current.state) !== expect)) {
             return { rows, result: { ok: false, current } };
         }
-        if (current === undefined && expect !== 'any' && expect !== 'absent') {
+        if (current === undefined && expect !== 'any' && expect !== 'absent' && expect !== 'verify') {
             return { rows, result: { ok: false, current: row } };
         }
         const normalized = { ...row, queue: queueOf(row.state) };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-merge",
   "description": "Skill auto-merge domain: screening, two-round authoring, queues and commit orchestration (community build)",
-  "version": "0.30.2",
+  "version": "0.30.4",
   "publishConfig": {
     "access": "public"
   },
@@ -27,8 +27,8 @@
   "license": "MIT",
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.5",
-    "@lmzhen/dsh-evolution-core": "^0.30.2",
-    "@lmzhen/dsh-evolution-merge-engine": "^0.30.2"
+    "@lmzhen/dsh-evolution-core": "^0.30.4",
+    "@lmzhen/dsh-evolution-merge-engine": "^0.30.4"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.5"