@qlingzzy/qling 1.0.0 → 1.1.0

package/dist/discovery-registry.d.ts

@@ -1,9 +1,18 @@
-import { DiscoverySource, DiscoveredItem } from "./discovery-types.js";
-import { ToolDefinition } from "./types.js";
+import type { DiscoverySource, DiscoveredItem } from "./discovery-types.js";
+import type { ToolDefinition } from "./types.js";
+import { type GuardConfig } from "./config.js";
+export interface DiscoveryRegistryOptions {
+    allowUnsigned?: boolean;
+    guardConfig?: GuardConfig;
+    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
+}
 export declare class DiscoveryRegistry {
     private items;
     private sources;
-    constructor(sources?: DiscoverySource[]);
+    private allowUnsigned;
+    private guardConfig;
+    private env;
+    constructor(sources?: DiscoverySource[], options?: DiscoveryRegistryOptions);
     /**
      * 同步所有源
      */
@@ -19,6 +28,11 @@ export declare class DiscoveryRegistry {
      * 获取所有发现的工具定义
      */
     getDiscoveredTools(): ToolDefinition[];
+    /**
+     * Manifest tool entries are metadata only until an executable handler or
+     * MCP transport has been bound. Never advertise metadata-only tools to the model.
+     */
+    getExecutableTools(): ToolDefinition[];
     /**
      * 获取所有发现的 MCP 服务器配置
      */

package/dist/discovery-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery-registry.d.ts","sourceRoot":"","sources":["../src/discovery-registry.ts"],"names":[],"mappings":"AASA,OAAO,EAAqB,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,KAAK,CAA0C;IACvD,OAAO,CAAC,OAAO,CAAyB;gBAE5B,OAAO,GAAE,eAAe,EAAO;IAI3C;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAK9B;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;YAY1C,SAAS;YAoBT,UAAU;IAWxB,OAAO,CAAC,YAAY;IAWpB;;OAEG;IACH,kBAAkB,IAAI,cAAc,EAAE;IAUtC;;OAEG;IACH,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAU9C,WAAW,IAAI,cAAc,EAAE;CAGhC"}
+{"version":3,"file":"discovery-registry.d.ts","sourceRoot":"","sources":["../src/discovery-registry.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAqB,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAGnE,MAAM,WAAW,wBAAwB;IACvC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC9D;AAiCD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,KAAK,CAA0C;IACvD,OAAO,CAAC,OAAO,CAAyB;IACxC,OAAO,CAAC,aAAa,CAAU;IAC/B,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,GAAG,CAAyD;gBAExD,OAAO,GAAE,eAAe,EAAO,EAAE,OAAO,GAAE,wBAA6B;IASnF;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAK9B;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;YAe1C,SAAS;YAoBT,UAAU;IAsCxB,OAAO,CAAC,YAAY;IAYpB;;OAEG;IACH,kBAAkB,IAAI,cAAc,EAAE;IAUtC;;;OAGG;IACH,kBAAkB,IAAI,cAAc,EAAE;IAItC;;OAEG;IACH,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAU9C,WAAW,IAAI,cAAc,EAAE;CAGhC"}

package/dist/discovery-registry.js

@@ -6,11 +6,49 @@ import * as fs from "fs/promises";
 import * as path from "path";
 import { existsSync } from "fs";
 import axios from "axios";
+import { guardConfigFromEnv } from "./config.js";
+import { appendGuardAudit, checkUrlFetchPolicy } from "./guard.js";
+const ENABLED_VALUES = new Set(["1", "true", "on", "yes"]);
+function isExplicitlyEnabled(raw) {
+    return ENABLED_VALUES.has(String(raw ?? "").trim().toLowerCase());
+}
+function assertValidManifest(value) {
+    if (!value || typeof value !== "object") {
+        throw new Error("manifest must be an object");
+    }
+    const manifest = value;
+    for (const key of ["id", "name", "version"]) {
+        if (typeof manifest[key] !== "string" || !manifest[key].trim()) {
+            throw new Error(`manifest.${key} must be a non-empty string`);
+        }
+    }
+    if (!new Set(["skill", "mcp", "bundle"]).has(String(manifest.type))) {
+        throw new Error("manifest.type must be skill, mcp, or bundle");
+    }
+    if (manifest.tools !== undefined) {
+        if (!Array.isArray(manifest.tools)) {
+            throw new Error("manifest.tools must be an array");
+        }
+        for (const tool of manifest.tools) {
+            if (!tool || typeof tool !== "object" || typeof tool.name !== "string" || !tool.name.trim()) {
+                throw new Error("manifest tool name must be a non-empty string");
+            }
+        }
+    }
+}
 export class DiscoveryRegistry {
     items = new Map();
     sources = [];
-    constructor(sources = []) {
+    allowUnsigned;
+    guardConfig;
+    env;
+    constructor(sources = [], options = {}) {
         this.sources = sources;
+        this.env = options.env ?? process.env;
+        this.allowUnsigned =
+            options.allowUnsigned ?? isExplicitlyEnabled(this.env.QLING_DISCOVERY_ALLOW_UNSIGNED);
+        this.guardConfig =
+            options.guardConfig ?? guardConfigFromEnv(this.env);
     }
     /**
      * 同步所有源
@@ -24,6 +62,9 @@ export class DiscoveryRegistry {
      */
     async syncSource(source) {
         try {
+            if (source.requireApproval) {
+                throw new Error("source requires approval, but no discovery approval callback is configured");
+            }
             if (source.type === "local") {
                 await this.syncLocal(source);
             }
@@ -57,9 +98,35 @@ export class DiscoveryRegistry {
     }
     async syncRemote(source) {
         try {
-            const resp = await axios.get(source.uri, { timeout: 10000 });
+            if (!this.allowUnsigned) {
+                throw new Error("unsigned remote discovery is disabled; set QLING_DISCOVERY_ALLOW_UNSIGNED=true only for a trusted source");
+            }
+            let target;
+            try {
+                target = new URL(source.uri);
+            }
+            catch {
+                throw new Error(`invalid remote manifest URL: ${source.uri}`);
+            }
+            const decision = await checkUrlFetchPolicy(target, this.guardConfig, this.env);
+            if (!decision.allowed) {
+                await appendGuardAudit(this.guardConfig, {
+                    tool: "dynamic_discovery",
+                    action: "deny",
+                    category: decision.category,
+                    target: target.toString(),
+                    reason: decision.reason,
+                });
+                throw new Error(decision.reason ?? "network guard denied remote manifest");
+            }
+            const resp = await axios.get(source.uri, {
+                timeout: 10_000,
+                maxRedirects: 0,
+                maxContentLength: 1024 * 1024,
+                maxBodyLength: 1024 * 1024,
+            });
             const manifest = resp.data;
-            // TODO: 签名校验
+            assertValidManifest(manifest);
             this.registerItem(source.id, manifest);
         }
         catch (err) {
@@ -67,6 +134,7 @@ export class DiscoveryRegistry {
         }
     }
     registerItem(sourceId, manifest) {
+        assertValidManifest(manifest);
         const id = manifest.id;
         this.items.set(id, {
             id,
@@ -88,6 +156,13 @@ export class DiscoveryRegistry {
         }
         return tools;
     }
+    /**
+     * Manifest tool entries are metadata only until an executable handler or
+     * MCP transport has been bound. Never advertise metadata-only tools to the model.
+     */
+    getExecutableTools() {
+        return [];
+    }
     /**
      * 获取所有发现的 MCP 服务器配置
      */

package/dist/doctor.d.ts

@@ -26,6 +26,14 @@ export interface DoctorOptions {
         detail: string;
     }>;
 }
+/** Phase 3 可选能力开关（informational） */
+export declare function buildPhase3FeatureChecks(env?: DoctorOptions["env"]): DoctorCheck[];
+/** Phase 5 韧性 / 验证管线（informational） */
+export declare function buildPhase5FeatureChecks(env?: DoctorOptions["env"], options?: {
+    exists?: (path: string) => boolean;
+    stateDir?: string;
+    verificationStagesSummary?: string;
+}): DoctorCheck[];
 export declare function buildDoctorReport(context: SlashCommandContext, options?: DoctorOptions): Promise<DoctorReport>;
 export declare function formatDoctorReport(report: DoctorReport): string[];
 //# sourceMappingURL=doctor.d.ts.map

package/dist/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAUjE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D;AA0PD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAmFvB;AAQD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,CAqBjE"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAUjE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D;AAgDD,oCAAoC;AACpC,wBAAgB,wBAAwB,CAAC,GAAG,GAAE,aAAa,CAAC,KAAK,CAAe,GAAG,WAAW,EAAE,CA0C/F;AAED,uCAAuC;AACvC,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,aAAa,CAAC,KAAK,CAAe,EACvC,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yBAAyB,CAAC,EAAE,MAAM,CAAC;CAC/B,GACL,WAAW,EAAE,CAyCf;AAqOD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CA4FvB;AAQD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,CAqBjE"}

package/dist/doctor.js

@@ -40,6 +40,111 @@ function envNumber(env, name) {
 function boolText(value) {
     return value ? "on" : "off";
 }
+function envFlagOn(env, name) {
+    const raw = envText(env, name).toLowerCase();
+    return raw === "1" || raw === "true" || raw === "on" || raw === "yes";
+}
+/** Phase 3 可选能力开关（informational） */
+export function buildPhase3FeatureChecks(env = process.env) {
+    const browserAct = envFlagOn(env, "QLING_BROWSER_ACT");
+    const parallel = envFlagOn(env, "QLING_SUBTASK_PARALLEL");
+    const missionNotify = envText(env, "QLING_MISSION_NOTIFY").toLowerCase();
+    const notifyOn = !(missionNotify === "off" || missionNotify === "0" || missionNotify === "false");
+    const logMode = envText(env, "QLING_MISSION_NOTIFY_LOGS") || "milestone";
+    const style = envText(env, "QLING_MISSION_NOTIFY_STYLE") || "rich";
+    const hasTg = Boolean(envText(env, "QLING_CHANNEL_TELEGRAM_TOKEN"));
+    const hasSlack = Boolean(envText(env, "QLING_CHANNEL_SLACK_BOT_TOKEN"));
+    return [
+        {
+            id: "phase3_browser_act",
+            label: "phase3:browser_act",
+            status: browserAct ? "pass" : "warn",
+            detail: browserAct
+                ? "QLING_BROWSER_ACT=on（交互浏览已启用）"
+                : "默认关闭；启用设 QLING_BROWSER_ACT=1，见 docs/web-routing.md",
+        },
+        {
+            id: "phase3_subtask_parallel",
+            label: "phase3:subtask_parallel",
+            status: parallel ? "pass" : "warn",
+            detail: parallel
+                ? "QLING_SUBTASK_PARALLEL=on（explore 并行已启用）"
+                : "默认关闭；启用设 QLING_SUBTASK_PARALLEL=1",
+        },
+        {
+            id: "phase3_mission_notify",
+            label: "phase3:mission_notify",
+            status: notifyOn && (hasTg || hasSlack) ? "pass" : notifyOn ? "warn" : "pass",
+            detail: `notify=${notifyOn ? "on" : "off"} style=${style} logs=${logMode} telegram=${hasTg ? "token" : "none"} slack=${hasSlack ? "token" : "none"}`,
+        },
+        {
+            id: "phase4_lsp",
+            label: "phase4:lsp",
+            status: envFlagOn(env, "QLING_LSP") ? "pass" : "warn",
+            detail: envFlagOn(env, "QLING_LSP")
+                ? "QLING_LSP=on（TS LanguageService 语义查询已启用）"
+                : "默认关闭；启用设 QLING_LSP=1（需 typescript 包）",
+        },
+    ];
+}
+/** Phase 5 韧性 / 验证管线（informational） */
+export function buildPhase5FeatureChecks(env = process.env, options = {}) {
+    const exists = options.exists ?? existsSync;
+    const stateDir = options.stateDir || envText(env, "QLING_FILE_STATE_DIR") || DEFAULT_STATE_DIR;
+    const runsDir = join(stateDir, "runs");
+    const sameFp = envNumber(env, "QLING_RECOVERY_SAME_FINGERPRINT_LIMIT") || 2;
+    const strategyBudget = envNumber(env, "QLING_RECOVERY_STRATEGY_LIMIT") || 4;
+    const stagesSummary = options.verificationStagesSummary ||
+        summarizeEnvVerificationStages(env);
+    const verifyLlm = envFlagOn(env, "QLING_VERIFY_LLM");
+    return [
+        {
+            id: "phase5_recovery_budget",
+            label: "phase5:recovery_budget",
+            status: "pass",
+            detail: `same_fingerprint_limit=${sameFp} strategy_attempt_limit=${strategyBudget}（硬停: 审批/沙箱/重复动作）`,
+        },
+        {
+            id: "phase5_run_traces",
+            label: "phase5:run_traces",
+            status: exists(runsDir) ? "pass" : "warn",
+            detail: exists(runsDir)
+                ? `trace_dir=${resolve(runsDir)}（脱敏 JSONL，30 天 / 50 MiB）`
+                : `trace_dir=${resolve(runsDir)} 尚未创建；首次失败恢复后生成`,
+        },
+        {
+            id: "phase5_verifier_stages",
+            label: "phase5:verifier_stages",
+            status: stagesSummary.startsWith("none") ? "warn" : "pass",
+            detail: stagesSummary,
+        },
+        {
+            id: "phase5_verify_llm_advisory",
+            label: "phase5:verify_llm_advisory",
+            status: verifyLlm ? "warn" : "pass",
+            detail: verifyLlm
+                ? "QLING_VERIFY_LLM=on（deprecated VerificationAgent LLM 旁路；不驱动恢复）"
+                : "默认规则旁路；恢复闭环仅 StagedVerifier",
+        },
+    ];
+}
+function summarizeEnvVerificationStages(env) {
+    // Lazy import avoidance: inline minimal summary for doctor without agent loop
+    const parts = [];
+    const stages = envText(env, "QLING_VERIFY_STAGES");
+    if (stages)
+        parts.push(`QLING_VERIFY_STAGES set`);
+    if (envText(env, "QLING_VERIFY_TYPECHECK_CMD"))
+        parts.push("typecheck");
+    if (envText(env, "QLING_VERIFY_TEST_CMD"))
+        parts.push("test");
+    if (envText(env, "QLING_VERIFY_FULL_CMD"))
+        parts.push("full_gate");
+    if (parts.length === 0) {
+        return "none（可设 /verify set 或 QLING_VERIFY_TYPECHECK_CMD / QLING_VERIFY_TEST_CMD / QLING_VERIFY_STAGES）";
+    }
+    return parts.join(" + ");
+}
 function buildConfigCheck(env) {
     const provider = envText(env, "QLING_LLM_PROVIDER") || "unset";
     const model = envText(env, "QLING_LLM_MODEL") || "unset";
@@ -82,6 +187,9 @@ async function buildSecretsCheck() {
 function buildRecommendations(checks) {
     const recommendations = [];
     const byId = new Map(checks.map((check) => [check.id, check]));
+    if (byId.get("phase5_verifier_stages")?.status === "warn") {
+        recommendations.push("- 写操作恢复验证：`/verify set \"npm test\"` 或设置 `QLING_VERIFY_TYPECHECK_CMD` / `QLING_VERIFY_TEST_CMD`。");
+    }
     if (byId.get("config")?.status === "warn") {
         const text = getLocalizedText();
         recommendations.push("- 新用户优先运行 `qling bootstrap` 完成本机初始化检查。");
@@ -305,6 +413,14 @@ export async function buildDoctorReport(context, options = {}) {
             status: ollama.ok ? "pass" : "warn",
             detail: ollama.detail,
         },
+        ...buildPhase3FeatureChecks(env),
+        ...buildPhase5FeatureChecks(env, {
+            exists,
+            stateDir,
+            verificationStagesSummary: typeof context.agentLoop?.getVerificationStagesSummary === "function"
+                ? context.agentLoop.getVerificationStagesSummary()
+                : undefined,
+        }),
     ];
     return {
         checks,

package/dist/eval/llm-tasks.d.ts

@@ -0,0 +1,5 @@
+import type { EvalTask } from "./types.js";
+export declare function resolveChatCompletionsUrl(endpoint: string): string;
+export declare function isExactQok(content: string): boolean;
+export declare function buildEvalLlmTasks(): EvalTask[];
+//# sourceMappingURL=llm-tasks.d.ts.map

package/dist/eval/llm-tasks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-tasks.d.ts","sourceRoot":"","sources":["../../src/eval/llm-tasks.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAmB,MAAM,YAAY,CAAC;AA6B5D,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKlE;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,wBAAgB,iBAAiB,IAAI,QAAQ,EAAE,CAgF9C"}

package/dist/eval/llm-tasks.js

@@ -0,0 +1,125 @@
+// ============================================================
+// Phase 4.1 — 可选 LLM 评测任务（默认 skip，不进 ci:check）
+// 启用：QLING_EVAL_LLM=1 且具备 API key
+// ============================================================
+import axios from "axios";
+function resolveApiKey(env) {
+    return (env.QLING_LLM_API_KEY ||
+        env.DEEPSEEK_API_KEY ||
+        env.OPENAI_API_KEY ||
+        "").trim();
+}
+function llmEvalEnabled(env) {
+    const raw = String(env.QLING_EVAL_LLM ?? "").trim().toLowerCase();
+    return raw === "1" || raw === "true" || raw === "on" || raw === "yes";
+}
+function resolveEndpoint(env) {
+    return (env.QLING_LLM_ENDPOINT ||
+        env.OPENAI_BASE_URL ||
+        env.DEEPSEEK_BASE_URL ||
+        "https://api.deepseek.com").replace(/\/$/, "");
+}
+function resolveModel(env) {
+    return env.QLING_LLM_MODEL || "deepseek-chat";
+}
+export function resolveChatCompletionsUrl(endpoint) {
+    const normalized = endpoint.replace(/\/+$/, "");
+    if (/\/chat\/completions$/i.test(normalized))
+        return normalized;
+    if (/\/v1$/i.test(normalized))
+        return `${normalized}/chat/completions`;
+    return `${normalized}/v1/chat/completions`;
+}
+export function isExactQok(content) {
+    return content.trim().toLowerCase() === "qok";
+}
+export function buildEvalLlmTasks() {
+    return [
+        {
+            id: "llm-gate-enabled",
+            title: "LLM eval 开关与密钥门禁",
+            run: async ({ env }) => {
+                if (!llmEvalEnabled(env)) {
+                    return {
+                        ok: true,
+                        skip: true,
+                        detail: "QLING_EVAL_LLM 未开启；跳过真实 LLM 评测",
+                    };
+                }
+                if (!resolveApiKey(env)) {
+                    return {
+                        ok: true,
+                        skip: true,
+                        detail: "无 API key（QLING_LLM_API_KEY / DEEPSEEK_API_KEY / OPENAI_API_KEY）",
+                    };
+                }
+                return {
+                    ok: true,
+                    detail: `enabled model=${resolveModel(env)} endpoint=${resolveEndpoint(env)}`,
+                };
+            },
+        },
+        {
+            id: "llm-chat-connectivity",
+            title: "LLM chat 连通性（固定短语）",
+            run: async (ctx) => {
+                const gate = await gateOrSkip(ctx);
+                if (gate)
+                    return gate;
+                const env = ctx.env;
+                const apiKey = resolveApiKey(env);
+                const endpoint = resolveEndpoint(env);
+                const model = resolveModel(env);
+                const url = resolveChatCompletionsUrl(endpoint);
+                try {
+                    const resp = await axios.post(url, {
+                        model,
+                        messages: [
+                            {
+                                role: "user",
+                                content: 'Reply with exactly the three letters QOK and nothing else. No punctuation.',
+                            },
+                        ],
+                        max_tokens: 16,
+                        temperature: 0,
+                    }, {
+                        headers: {
+                            Authorization: `Bearer ${apiKey}`,
+                            "Content-Type": "application/json",
+                        },
+                        timeout: 45_000,
+                    });
+                    const content = String(resp.data?.choices?.[0]?.message?.content ?? "").trim();
+                    const ok = isExactQok(content);
+                    return {
+                        ok,
+                        detail: `model=${model} reply=${JSON.stringify(content).slice(0, 120)}`,
+                    };
+                }
+                catch (err) {
+                    return {
+                        ok: false,
+                        detail: err instanceof Error ? err.message : String(err),
+                    };
+                }
+            },
+        },
+    ];
+}
+async function gateOrSkip(ctx) {
+    if (!llmEvalEnabled(ctx.env)) {
+        return {
+            ok: true,
+            skip: true,
+            detail: "QLING_EVAL_LLM 未开启",
+        };
+    }
+    if (!resolveApiKey(ctx.env)) {
+        return {
+            ok: true,
+            skip: true,
+            detail: "missing API key",
+        };
+    }
+    return null;
+}

package/dist/eval/repo-tasks.d.ts

@@ -0,0 +1,12 @@
+import type { EvalTask } from "./types.js";
+/**
+ * 10 个本地 fixture：每个任务自带 broken 状态 + 确定性修复步骤。
+ * 不调用外部 LLM；用于回归「编码工作台」基础能力与验收脚本。
+ */
+export declare function buildEvalRepoTasks(): EvalTask[];
+/** 仅 materialize fixture，不自动修复（供可选 LLM / 人工评测） */
+export declare function materializeBrokenFixture(workspaceDir: string, fixtureId: string): Promise<{
+    root: string;
+    prompt: string;
+} | null>;
+//# sourceMappingURL=repo-tasks.d.ts.map

package/dist/eval/repo-tasks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-tasks.d.ts","sourceRoot":"","sources":["../../src/eval/repo-tasks.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAoC,MAAM,YAAY,CAAC;AAiC7E;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,QAAQ,EAAE,CAwO/C;AAED,kDAAkD;AAClD,wBAAsB,wBAAwB,CAC5C,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAwBlD"}