@marsken/dsh-studio 0.1.18 → 0.1.20

package/docs/compatibility.md

@@ -6,7 +6,7 @@
 
 | 项 | 值 |
 | --- | --- |
-| dsh-studio | `package.json` `version: 0.1.18` |
+| dsh-studio | `package.json` `version: 0.1.20` |
 | DeepSeek Harness | `0.2.2-rc.1`（`dsh --version`） |
 | Node | `v24.22.2`（Linux 目标机）；本机 Windows `v24.19.0` |
 | 目标系统 | Ubuntu 24.04，`dsh web` 监听 `18080`，nginx `:80` 反代并注入 `dsh-auth-*` cookie |

package/docs/publish.md

@@ -127,6 +127,8 @@ token 只写进临时 npmrc（放在仓库外或 `tmp/` 且不提交），发完
 | --- | --- | --- |
 | `0.1.0` | 2026-11-13 | 首个公开版：看板 / 需求 / 用例回归 / 效能 / 设计评审四期 |
 | `0.1.1` | 2026-11-13 | 补三张 README 截图（npm 页可看图）；默认值与文档去掉公司内网信息 |
+| `0.1.20` | 2026-11-15 | 拆卡时提示「有后端但功能点没覆盖后端」 |
+| `0.1.19` | 2026-11-15 | 需求澄清三问 + 拆卡门禁；修补答保存不上的白名单漏字段 |
 | `0.1.17` | 2026-11-15 | 截图补到 10 张，且有脚本可重跑 |
 | `0.1.16` | 2026-11-15 | quickstart 命令修正 + GitLab 打桩验证配方 |
 | `0.1.15` | 2026-11-15 | 清掉三处过期的「已知限制」 |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marsken/dsh-studio",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "type": "module",
   "description": "DSH Studio: role-based multi-agent workspace (product / architect / developer / QA) with a live work board, GitLab + Feishu connection settings, all configurable from the web GUI.",
   "main": "index.js",

package/src/host/discovery.js

@@ -0,0 +1,41 @@
+// 需求澄清的必答项：不问清楚就会出现「管理后台只交付了前端」这类返工。
+// 纯函数，拆卡门禁和界面提示共用。
+
+export const DISCOVERY_FIELDS = [
+  ['server', '有没有服务端？数据存在哪、刷新会不会丢'],
+  ['auth', '鉴权谁做：前端隐藏按钮，还是服务端拒绝'],
+  ['boundary', '交付边界：只交付界面，还是点开就能用'],
+]
+
+export function sanitizeDiscovery(raw) {
+  const input = raw !== null && typeof raw === 'object' ? raw : {}
+  return {
+    server: String(input.server ?? '').trim().slice(0, 300),
+    auth: String(input.auth ?? '').trim().slice(0, 300),
+    boundary: String(input.boundary ?? '').trim().slice(0, 300),
+  }
+}
+
+const BACKEND_HINT = /接口|api|数据库|数据表|建表|后端|服务端|鉴权|sqlite|postgres|持久化|存储/i
+const BACKEND_YES = /^(有|yes|是|需要|要)/i
+
+/**
+ * 说了「有服务端」，功能点里却没有一条跟后端有关 —— 大概率又要只交付一半。
+ * 只提示、不拦：有的需求后端在别的仓库或别的需求里，硬拦会误伤。
+ */
+export function backendCoverageWarning(requirement) {
+  const answer = String(requirement?.discovery?.server ?? '').trim()
+  if (answer === '' || BACKEND_YES.test(answer) !== true) return null
+  const points = Array.isArray(requirement?.points) ? requirement.points : []
+  const hit = points.some(point => BACKEND_HINT.test(String(point?.title ?? '') + ' ' + String(point?.description ?? '')))
+  if (hit) return null
+  return '澄清里说有服务端，但功能点没有一条讲接口 / 数据表 / 鉴权：后端在哪一块交付？'
+}
+
+/** 还缺哪几项澄清；空了才允许拆卡。 */
+export function discoveryGaps(requirement) {
+  const discovery = requirement?.discovery ?? {}
+  return DISCOVERY_FIELDS
+    .filter(([key]) => String(discovery[key] ?? '').trim() === '')
+    .map(([, label]) => label)
+}

package/src/host/domain.js

@@ -1,6 +1,7 @@
 /** dsh-studio 的领域层：板列、卡片/需求/发布的数据形状与清洗、默认配置、编号生成。纯函数，可单测。 */
 import { createHash, randomBytes } from 'node:crypto'
 import { sanitizeDbCase } from './db-runner.js'
+import { sanitizeDiscovery } from './discovery.js'
 import { sanitizePrices } from './usage.js'
 import { sanitizeWebhooks } from './webhooks.js'
 import { sanitizeCaseShell } from './shell-case.js'
@@ -979,8 +980,7 @@ export function sanitizeRequirement(raw) {
   const title = String(raw.title ?? '').trim().slice(0, 200)
   if (title.length === 0) return undefined
   const now = Date.now()
-  const links = raw.links !== null && typeof raw.links === 'object' ? raw.links : {}
-  const folderRaw = raw.folder !== null && typeof raw.folder === 'object' ? raw.folder : {}
+  const links = raw.links !== null && typeof raw.links === 'object' ? raw.links : {}, folderRaw = raw.folder !== null && typeof raw.folder === 'object' ? raw.folder : {}
   return {
     id: cleanId(raw.id ?? '', 'req'),
     code: String(raw.code ?? '').trim().toUpperCase().slice(0, 40),
@@ -992,6 +992,7 @@ export function sanitizeRequirement(raw) {
     /** 业务领域：卡没写领域时继承它，用来把卡路由给同领域专家。 */
     domain: String(raw.domain ?? '').trim().slice(0, 40),
     priority: PRIORITIES.includes(String(raw.priority)) ? String(raw.priority) : 'normal',
+    discovery: sanitizeDiscovery(raw.discovery), // 澄清三问，空的会在拆卡时被拦
     status: REQ_STATUSES.includes(String(raw.status)) ? String(raw.status) : 'draft',
     links: {
       prd: String(links.prd ?? '').trim().slice(0, 500),
@@ -1854,8 +1855,7 @@ export function sanitizeReleases(input) {
 
 export function sanitizeRelease(raw, index = 0) {
   if (raw === null || typeof raw !== 'object') return null
-  const version = String(raw.version ?? '').trim().slice(0, 40)
-  const name = String(raw.name ?? '').trim().slice(0, 120)
+  const version = String(raw.version ?? '').trim().slice(0, 40), name = String(raw.name ?? '').trim().slice(0, 120)
   if (version === '' && name === '') return null
   return {
     id: cleanId(raw.id ?? (version === '' ? name : version), `rel-${index}`),

package/src/host/executor.js

@@ -515,7 +515,8 @@ export async function saveRequirement(store, input) {
       points: requirementPointsFingerprint(existing.points),
       links: JSON.stringify(existing.links ?? {}),
     }
-    for (const key of ['title', 'description', 'project', 'iteration', 'owner', 'domain', 'priority', 'status', 'links']) {
+    // 更新时的字段白名单：漏一个就会「保存成功但字段没变」（discovery 就是这样丢过一次）
+    for (const key of ['title', 'description', 'project', 'iteration', 'owner', 'domain', 'priority', 'status', 'links', 'discovery']) {
       existing[key] = draft[key]
     }
     // 排序与依赖单独处理：显式给了才覆盖，避免详情页保存别的字段时把它们清空。

package/src/host/routes/requirements.js

@@ -7,6 +7,7 @@ import {
   sanitizeRequirementPool,
   text,
 } from '../domain.js'
+import { backendCoverageWarning, discoveryGaps } from '../discovery.js'
 import { casesOfTasks, impactSummary } from '../impact.js'
 import {
   ensureReqFolder,
@@ -198,6 +199,8 @@ export async function handleRequirementRoute({ method, route, req, res, store, u
     const approved = (requirement.review ?? null)?.status === 'approved'
     const started = ['active', 'delivered', 'closed'].includes(requirement.status)
     if (!approved && !started) throw new Error('需求还没评审通过，先过评审再拆卡')
+    const gaps = discoveryGaps(requirement)
+    if (gaps.length > 0) throw new Error('拆卡前先把澄清答完：' + gaps.join('；'))
     const points = (requirement.points ?? []).filter(point => requested.length === 0 || requested.includes(point.id))
     const uncovered = points.filter(point => !before.tasks.some(task => task.requirementId === id && task.pointId === point.id))
     if (uncovered.length === 0) throw new Error('这些功能点都已经有卡了')
@@ -216,7 +219,9 @@ export async function handleRequirementRoute({ method, route, req, res, store, u
       })
       created.push(task)
     }
-    host.sendJson(res, 200, { ok: true, created, state: host.publicState(store) })
+    // 说了有后端却没有后端功能点：给个提示，不拦（后端可能确实在别的需求里）
+    const warning = backendCoverageWarning(requirement)
+    host.sendJson(res, 200, { ok: true, created, warnings: warning === null ? [] : [warning], state: host.publicState(store) })
     return true
   }
   if (method === 'POST' && route === '/requirement/pool') {