@tea-agent/loop-agent 0.20.1 → 0.21.0

package/dist/workflows/dag/backend-test-markdown-workflow.js

@@ -4,6 +4,9 @@ import path from "node:path";
 const CASE_ID = /\bBE-[A-Z0-9]+(?:-[A-Z0-9]+)*-\d{3}\b/g;
 const AC_ID = /\bAC-[A-Z0-9]+(?:-[A-Z0-9]+)*\b/g;
 const SECRET = /(?:password|passwd|secret|token|api[_-]?key|private[_-]?key|authorization)\s*[:=]\s*\S+/i;
+const SECRET_ASSIGNMENT = /\b(password|passwd|secret|token|api[_-]?key|private[_-]?key|authorization|cookie|set-cookie|credential)\b\s*[:=]\s*([^\r\n,;]+)/gi;
+const SECRET_VALUE = /-----BEGIN [A-Z ]*PRIVATE KEY-----|\b(?:ghp|github_pat|xox[baprs]|AKIA|sk)[-_A-Za-z0-9]{12,}\b/i;
+const PLACEHOLDER_SECRET_VALUE = /^(?:<[^>]+>|\$\{[^}]+\}|\*+|x+|redacted|masked|example(?:[-_].*)?|sample(?:[-_].*)?|dummy(?:[-_].*)?|test(?:[-_].*)?|your[-_].*)$/i;
 const PLACEHOLDER = /\b(?:TODO|TBD|FIXME)\b|后续补充|暂不实现|接口正常|结果正确|按实际情况处理/i;
 const CASE_SECTION_ALIASES = {
     acceptanceCriteria: ["Acceptance Criteria", "验收标准"],
@@ -16,12 +19,9 @@ const CASE_SECTION_ALIASES = {
     testPurpose: ["Test Purpose", "测试目的", "测试场景"],
 };
 const REQUIRED_CASE_SECTIONS = [
-    CASE_SECTION_ALIASES.acceptanceCriteria,
-    CASE_SECTION_ALIASES.sourceReferences,
     CASE_SECTION_ALIASES.preconditions,
     CASE_SECTION_ALIASES.steps,
     CASE_SECTION_ALIASES.expectedResults,
-    CASE_SECTION_ALIASES.automationNotes,
 ];
 async function exists(filePath) {
     try {
@@ -217,7 +217,8 @@ function extractSourceReferences(input) {
     return unique([...boundMatches, ...citedPaths]);
 }
 function hasNumberedListItem(value) {
-    return /^\s*\d+[.)]\s+\S+/m.test(value);
+    return (/^\s*\d+[.)]\s+\S+/m.test(value) ||
+        /^\s*\|\s*\d+\s*\|\s*\S+/m.test(value));
 }
 function hasAssertableExpectedResult(value) {
     return /^\s*(?:\d+[.)]|[-*+])\s+\S+/m.test(value);
@@ -303,94 +304,158 @@ function findUnsafeSwallowedException(source) {
     }
     return null;
 }
+function resolvesSharedLoggingHelper(source) {
+    return /\b(?:LoggedHttpClient|LoggedApiClient|LoggingHttpClient|HttpLoggingClient)\b/.test(source);
+}
+function httpLoggingFindings(relativeScript, source) {
+    if (resolvesSharedLoggingHelper(source))
+        return [];
+    const hasHttpRequest = /\b(?:requests\.(?:get|post|put|patch|delete|request)|httpx\.(?:get|post|put|patch|delete|request)|(?:client|session|api_client)\.(?:get|post|put|patch|delete|request))\s*\(/i.test(source);
+    if (!hasHttpRequest)
+        return [];
+    const findings = [];
+    const hasRequestLog = /(?:print|log(?:ger)?\.(?:debug|info|warning|error))\s*\([^\n]*(?:request|请求)[^\n]*(?:method|url|path|params|query|json|body|payload|参数)/i.test(source);
+    const hasResponseLog = /(?:print|log(?:ger)?\.(?:debug|info|warning|error))\s*\([^\n]*(?:response|响应)[^\n]*(?:status|status_code|body|json|text|result|结果)/i.test(source);
+    const hasSanitizer = /\b(?:sanitize|sanitise|redact|mask)[A-Za-z0-9_]*\s*\(|\b[A-Za-z0-9_]*(?:sanitize|sanitise|redact|mask)[A-Za-z0-9_]*\s*\(/i.test(source);
+    const hasBoundedOutput = /(?:MAX_[A-Z_]*(?:LOG|BODY|RESPONSE)|max_(?:log|body|response)|truncate|truncat|\[:\s*\d{3,}\s*\])/i.test(source);
+    if (!hasRequestLog)
+        findings.push(`request logging evidence is missing in mapped backend pytest: ${relativeScript}`);
+    if (!hasResponseLog)
+        findings.push(`response logging evidence is missing in mapped backend pytest: ${relativeScript}`);
+    if (!hasSanitizer)
+        findings.push(`recursive redaction evidence is missing in mapped backend pytest: ${relativeScript}`);
+    if (!hasBoundedOutput)
+        findings.push(`bounded log truncation evidence is missing in mapped backend pytest: ${relativeScript}`);
+    return findings;
+}
+function markdownSecretFindings(relativeFile, markdown) {
+    const findings = [];
+    if (SECRET_VALUE.test(markdown)) {
+        findings.push(`secret-shaped value detected in ${relativeFile}`);
+    }
+    for (const match of markdown.matchAll(SECRET_ASSIGNMENT)) {
+        const value = match[2]
+            .trim()
+            .replace(/^bearer\s+/i, "")
+            .replace(/^['"`]|['"`]$/g, "");
+        if (!PLACEHOLDER_SECRET_VALUE.test(value)) {
+            findings.push(`secret-shaped ${match[1].toLowerCase()} value detected in ${relativeFile}`);
+        }
+    }
+    return unique(findings);
+}
+export function hasBlockingBackendMarkdownSafetyFindings(report) {
+    return /^## Safety Status\s*\r?\n\s*BLOCKED\s*$/m.test(report);
+}
 export async function validateBackendMarkdownCases(input) {
-    const files = await markdownFiles(input.workspaceRoot);
+    const findings = [];
+    const safetyFindings = [];
+    let files = [];
+    try {
+        files = await markdownFiles(input.workspaceRoot);
+    }
+    catch {
+        findings.push("missing testcase/md directory");
+    }
     const readme = path.join(input.workspaceRoot, "testcase", "md", "README.md");
     if (!(await exists(readme)))
-        throw new Error("missing testcase/md/README.md");
+        findings.push("missing testcase/md/README.md");
     const moduleFiles = files.filter((file) => path.basename(file).toLowerCase() !== "readme.md");
     if (moduleFiles.length === 0)
-        throw new Error("no testcase/md module case file found");
+        findings.push("no testcase/md module case file found");
     const seen = new Map();
     const coveredAc = new Set();
     let caseCount = 0;
     for (const file of moduleFiles) {
+        const relativeFile = path.relative(input.workspaceRoot, file).replaceAll(path.sep, "/");
         const markdown = await readFile(file, "utf8");
-        if (!markdown.trim())
-            throw new Error(`empty Markdown case file: ${path.relative(input.workspaceRoot, file)}`);
-        if (SECRET.test(markdown))
-            throw new Error(`secret-shaped content in ${path.relative(input.workspaceRoot, file)}`);
-        if (PLACEHOLDER.test(markdown))
-            throw new Error(`placeholder or non-assertable wording in ${path.relative(input.workspaceRoot, file)}`);
+        safetyFindings.push(...markdownSecretFindings(relativeFile, markdown));
+        if (!markdown.trim()) {
+            findings.push(`empty Markdown case file: ${relativeFile}`);
+            continue;
+        }
+        if (PLACEHOLDER.test(markdown)) {
+            findings.push(`placeholder or non-assertable wording in ${relativeFile}`);
+        }
         const cases = splitCases(markdown);
-        if (cases.length === 0)
-            throw new Error(`no BE-<MODULE>-<NNN> case heading in ${path.relative(input.workspaceRoot, file)}`);
+        if (cases.length === 0) {
+            findings.push(`no BE-<MODULE>-<NNN> case heading in ${relativeFile}`);
+            continue;
+        }
         for (const testCase of cases) {
             caseCount += 1;
             const previous = seen.get(testCase.id);
-            if (previous)
-                throw new Error(`duplicate case id ${testCase.id}: ${previous} and ${path.relative(input.workspaceRoot, file)}`);
-            seen.set(testCase.id, path.relative(input.workspaceRoot, file).replaceAll(path.sep, "/"));
+            if (previous) {
+                findings.push(`duplicate case id ${testCase.id}: ${previous} and ${relativeFile}`);
+            }
+            else {
+                seen.set(testCase.id, relativeFile);
+            }
             for (const sectionAliases of REQUIRED_CASE_SECTIONS) {
                 const sectionPattern = sectionAliases.map(escapeRegExp).join("|");
                 if (!new RegExp(`^###\\s+(?:${sectionPattern})\\s*$`, "mi").test(testCase.body)) {
-                    throw new Error(`${testCase.id} missing section: ${sectionAliases.join(" or ")}`);
+                    findings.push(`${testCase.id} missing section: ${sectionAliases.join(" or ")}`);
                 }
             }
             const acIds = unique(testCase.body.match(AC_ID) ?? []);
             acIds.forEach((id) => coveredAc.add(id));
-            const sourceSection = sectionBody(testCase.body, CASE_SECTION_ALIASES.sourceReferences);
-            const sourceRefs = extractSourceReferences({
-                sourceSection,
-                sourceBinding: input.sourceBinding,
-            });
-            if (sourceRefs.length === 0) {
-                throw new Error(`${testCase.id} has no task-relative source reference`);
-            }
-            for (const sourceRef of sourceRefs) {
-                if (/\.env(?:\.|$)|credential|secret/i.test(sourceRef)) {
-                    throw new Error(`${testCase.id} references a forbidden source path: ${sourceRef}`);
-                }
-                const resolvedSourcePath = resolveBoundSourceReference({
-                    workspaceRoot: input.workspaceRoot,
-                    sourceRef,
-                    sourceBinding: input.sourceBinding,
-                });
-                if (!(await exists(resolvedSourcePath))) {
-                    throw new Error(`${testCase.id} references a missing source path: ${sourceRef}`);
-                }
-            }
             const steps = sectionBody(testCase.body, CASE_SECTION_ALIASES.steps);
             const expected = sectionBody(testCase.body, CASE_SECTION_ALIASES.expectedResults);
-            if (!hasNumberedListItem(steps))
-                throw new Error(`${testCase.id} has no numbered executable step`);
-            if (!hasAssertableExpectedResult(expected))
-                throw new Error(`${testCase.id} has no structured expected result`);
+            if (!hasNumberedListItem(steps)) {
+                findings.push(`${testCase.id} has no numbered executable step`);
+            }
+            if (!hasAssertableExpectedResult(expected)) {
+                findings.push(`${testCase.id} has no structured expected result`);
+            }
         }
     }
     const missing = input.requiredRequirementIds.filter((id) => !coveredAc.has(id));
-    if (missing.length > 0)
-        throw new Error(`required AC IDs are not covered by final Markdown cases: ${missing.join(", ")}`);
+    if (missing.length > 0) {
+        findings.push(`required AC IDs are not covered by final Markdown cases: ${missing.join(", ")}`);
+    }
+    const status = findings.length === 0 ? "PASS" : "FAIL";
     const report = [
         "# Backend Markdown Case Validation",
         "",
         "## Status",
         "",
-        "PASS",
+        status,
         "",
         `- Markdown files: ${files.length}`,
         `- Module files: ${moduleFiles.length}`,
         `- Cases: ${caseCount}`,
         `- Covered AC IDs: ${[...coveredAc].sort().join(", ") || "none"}`,
         `- Environment evidence present: ${input.environmentMarkdown.trim() ? "yes" : "no"}`,
-        "- Duplicate case IDs: 0",
-        "- Secret-shaped findings: 0",
+        `- Findings: ${findings.length}`,
+        "- Required sections: Preconditions/前置条件, Steps/操作步骤, Expected Results/预期结果",
+        "- Source-reference validity check: not applied",
+        "- Markdown quality sensitive-information finding: not advisory; see Safety Status",
+        "",
+        "## Safety Status",
+        "",
+        safetyFindings.length > 0 ? "BLOCKED" : "PASS",
+        "",
+        ...(safetyFindings.length > 0
+            ? safetyFindings.map((finding) => `- ${finding}`)
+            : ["- No secret-shaped values detected."]),
+        "",
+        "## Findings",
+        "",
+        ...(findings.length > 0 ? findings.map((finding) => `- ${finding}`) : ["- None"]),
     ];
     return `${report.join("\n")}\n`;
 }
 function collectMarkdownCaseIds(markdown) {
     return splitCases(markdown).map((testCase) => testCase.id);
 }
+function extractMappedPytestScripts(testCaseBody) {
+    const automation = sectionBody(testCaseBody, CASE_SECTION_ALIASES.automationNotes);
+    if (!automation.trim())
+        return [];
+    return unique([...automation.matchAll(/`?(testcase\/[A-Za-z0-9_./-]*test_[A-Za-z0-9_.-]*\.py)`?/gi)]
+        .map((match) => match[1].replaceAll("\\", "/"))
+        .filter((value) => !value.includes("..")));
+}
 function testFunctionRegion(input) {
     const functionLineStart = input.source.lastIndexOf("\n", input.functionIndex - 1) + 1;
     const functionLine = input.source.slice(functionLineStart, input.functionHeaderEnd);
@@ -432,35 +497,53 @@ function symbolCaseId(symbol) {
 export async function validateBackendMarkdownTraceability(workspaceRoot) {
     const files = await markdownFiles(workspaceRoot);
     const markdownIds = new Set();
+    const expectedIdsByScript = new Map();
+    const findings = [];
     for (const file of files) {
         if (path.basename(file).toLowerCase() === "readme.md")
             continue;
         const content = await readFile(file, "utf8");
-        for (const id of collectMarkdownCaseIds(content))
-            markdownIds.add(id);
-    }
-    const testcaseRoot = path.join(workspaceRoot, "testcase");
-    const pythonFiles = [];
-    async function walk(directory) {
-        for (const entry of await readdir(directory, { withFileTypes: true })) {
-            const absolute = path.join(directory, entry.name);
-            if (entry.isDirectory())
-                await walk(absolute);
-            else if (/^test_.*\.py$/i.test(entry.name))
-                pythonFiles.push(absolute);
+        for (const testCase of splitCases(content)) {
+            markdownIds.add(testCase.id);
+            const scripts = extractMappedPytestScripts(testCase.body);
+            if (scripts.length === 0) {
+                findings.push(`${testCase.id} has no mapped pytest script in Automation Notes/自动化映射`);
+                continue;
+            }
+            for (const script of scripts) {
+                const bucket = expectedIdsByScript.get(script) ?? new Set();
+                bucket.add(testCase.id);
+                expectedIdsByScript.set(script, bucket);
+            }
         }
     }
-    await walk(testcaseRoot);
     const mappings = new Map();
     const automationIds = new Set();
-    for (const file of pythonFiles) {
-        const content = await readFile(file, "utf8");
+    let requestResponseLoggingFindingCount = 0;
+    for (const [relativeScript, expectedIds] of expectedIdsByScript) {
+        const absolute = path.resolve(workspaceRoot, relativeScript);
+        const relative = path.relative(workspaceRoot, absolute);
+        if (relative.startsWith("..") ||
+            path.isAbsolute(relative) ||
+            !relativeScript.startsWith("testcase/") ||
+            !/^test_.*\.py$/i.test(path.basename(relativeScript))) {
+            findings.push(`unsafe mapped pytest script: ${relativeScript}`);
+            continue;
+        }
+        if (!(await exists(absolute))) {
+            findings.push(`mapped pytest script is missing: ${relativeScript}`);
+            continue;
+        }
+        const content = await readFile(absolute, "utf8");
+        const loggingFindings = httpLoggingFindings(relativeScript, content);
+        requestResponseLoggingFindingCount += loggingFindings.length;
+        findings.push(...loggingFindings);
         if (/pytest\.(?:skip|xfail)\s*\(|@pytest\.mark\.(?:skip|xfail)\b/.test(content)) {
-            throw new Error(`skip/xfail is forbidden in generated backend pytest: ${path.relative(workspaceRoot, file)}`);
+            findings.push(`skip/xfail is forbidden in mapped backend pytest: ${relativeScript}`);
         }
         const unsafeSwallowedException = findUnsafeSwallowedException(content);
         if (unsafeSwallowedException) {
-            throw new Error(`swallowed exception is forbidden in generated backend pytest: ${path.relative(workspaceRoot, file)} (${unsafeSwallowedException})`);
+            findings.push(`swallowed exception is forbidden in mapped backend pytest: ${relativeScript} (${unsafeSwallowedException})`);
         }
         for (const match of content.matchAll(/^(\s*)(?:async\s+)?def\s+(test_[A-Za-z0-9_]+)\s*\([^)]*\)\s*(?:->\s*[^:\r\n]+)?\s*:/gm)) {
             const symbol = match[2];
@@ -475,10 +558,10 @@ export async function validateBackendMarkdownTraceability(workspaceRoot) {
                 associatedIds.add(fromSymbol);
             for (const id of associatedIds) {
                 automationIds.add(id);
-                if (!markdownIds.has(id))
+                if (!expectedIds.has(id))
                     continue;
                 const bucket = mappings.get(id) ?? [];
-                bucket.push(`${path.relative(workspaceRoot, file).replaceAll(path.sep, "/")}#${symbol}`);
+                bucket.push(`${relativeScript}#${symbol}`);
                 mappings.set(id, bucket);
             }
         }
@@ -489,7 +572,7 @@ export async function validateBackendMarkdownTraceability(workspaceRoot) {
         .map(([id]) => id);
     const extra = [...automationIds].filter((id) => !markdownIds.has(id));
     if (missing.length > 0) {
-        throw new Error(`traceability mismatch: missing=${missing.join(",")}; multiple=${multiple.join(",") || "none"}; extra=${extra.join(",") || "none"}`);
+        findings.push(`Markdown Case IDs without pytest mapping: ${missing.join(", ")}`);
     }
     const mappingCount = [...mappings.values()].reduce((total, refs) => total + refs.length, 0);
     return ([
@@ -497,17 +580,56 @@ export async function validateBackendMarkdownTraceability(workspaceRoot) {
         "",
         "## Status",
         "",
-        "PASS",
+        findings.length === 0 ? "PASS" : "FAIL",
         "",
         `- Markdown Case IDs: ${markdownIds.size}`,
         `- Covered Markdown Case IDs: ${mappings.size}`,
         `- Pytest mappings: ${mappingCount}`,
-        "- Missing mappings: 0",
+        `- Scanned pytest scripts: ${expectedIdsByScript.size}`,
+        `- Missing mappings: ${missing.length}${missing.length ? ` (${missing.join(", ")})` : ""}`,
         `- Multiple mappings: ${multiple.length}${multiple.length ? ` (${multiple.join(", ")})` : ""}`,
         `- Extra automation Case IDs: ${extra.length}${extra.length ? ` (${extra.join(", ")})` : ""}`,
-        "- skip/xfail findings: 0",
+        `- Request/response logging findings: ${requestResponseLoggingFindingCount}`,
+        "- Logging scope: mapped scripts with detected HTTP client calls; findings are advisory",
+        "- Scan scope: pytest scripts explicitly mapped by Markdown cases only",
+        "",
+        "## Findings",
+        "",
+        ...(findings.length > 0 ? findings.map((finding) => `- ${finding}`) : ["- None"]),
     ].join("\n") + "\n");
 }
+export async function collectBackendTestMappedPytestScripts(workspaceRoot) {
+    const files = await markdownFiles(workspaceRoot);
+    const scripts = new Set();
+    for (const file of files) {
+        if (path.basename(file).toLowerCase() === "readme.md")
+            continue;
+        const markdown = await readFile(file, "utf8");
+        for (const testCase of splitCases(markdown)) {
+            for (const script of extractMappedPytestScripts(testCase.body))
+                scripts.add(script);
+        }
+    }
+    if (scripts.size === 0) {
+        throw new Error("no pytest scripts are mapped by final Markdown cases");
+    }
+    const safeScripts = [];
+    for (const script of unique(scripts)) {
+        const absolute = path.resolve(workspaceRoot, script);
+        const relative = path.relative(workspaceRoot, absolute);
+        if (relative.startsWith("..") ||
+            path.isAbsolute(relative) ||
+            !script.startsWith("testcase/") ||
+            !/^test_.*\.py$/i.test(path.basename(script))) {
+            throw new Error(`unsafe mapped pytest script: ${script}`);
+        }
+        if (!(await exists(absolute))) {
+            throw new Error(`mapped pytest script is missing: ${script}`);
+        }
+        safeScripts.push(script);
+    }
+    return safeScripts;
+}
 function cleanCaseTitle(rawHeading, id) {
     return rawHeading
         .replace(/^##\s+/, "")
@@ -596,69 +718,141 @@ function escapeHtml(value) {
         .replaceAll(">", "&gt;")
         .replaceAll('"', "&quot;");
 }
+function reportOutputLines(value, prefix) {
+    if (!value?.trim())
+        return [];
+    return value
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith(prefix))
+        .map((line) => redactBackendTestOutput(line.slice(prefix.length).trim()).slice(0, 4000));
+}
+function requestResponseSummary(result) {
+    const combined = [result.stdout, result.stderr].filter(Boolean).join("\n");
+    return {
+        requests: reportOutputLines(combined, "HTTP_REQUEST"),
+        responses: reportOutputLines(combined, "HTTP_RESPONSE"),
+    };
+}
+function reportDetails(title, values, emptyText) {
+    const body = values.length > 0
+        ? values.map((value) => `<pre>${escapeHtml(value)}</pre>`).join("")
+        : `<p class="muted">${escapeHtml(emptyText)}</p>`;
+    return `<details class="io-details" open><summary>${escapeHtml(title)} <span>${values.length}</span></summary>${body}</details>`;
+}
+function parseAdvisorySummary(markdown) {
+    if (!markdown?.trim())
+        return { status: "Unavailable", findings: undefined, firstFinding: "未提供证据" };
+    const explicitStatus = markdown.match(/^## Status\s*\r?\n\s*(PASS|FAIL)\s*$/mi)?.[1]
+        ?? markdown.trim().match(/^(PASS|FAIL)$/i)?.[1]?.toUpperCase();
+    const status = explicitStatus;
+    const findings = Number(markdown.match(/^- Findings:\s*(\d+)\s*$/mi)?.[1]);
+    const findingLines = markdown
+        .split(/\r?\n/)
+        .slice(markdown.split(/\r?\n/).findIndex((line) => /^## Findings\s*$/.test(line.trim())) + 1)
+        .map((line) => line.trim())
+        .filter((line) => /^-\s+/.test(line) && !/^- None$/i.test(line));
+    const resolvedFindings = Number.isFinite(findings) ? findings : findingLines.length;
+    return {
+        status: status ?? "Unavailable",
+        findings: resolvedFindings,
+        firstFinding: findingLines[0]?.replace(/^-\s+/, "") ?? "无",
+    };
+}
+function advisoryBadge(status) {
+    const className = status === "PASS" ? "passed" : status === "FAIL" ? "failure" : "skipped";
+    return `<span class="status ${className}">${status === "Unavailable" ? "不可用" : status}</span>`;
+}
 export function renderBackendTestHtml(input) {
     const passRate = input.parsed.tests > 0 ? input.parsed.passed / input.parsed.tests : 0;
     const catalog = new Map((input.cases ?? []).map((item) => [item.id, item]));
     const rows = input.parsed.cases.map((result) => {
         const caseId = junitCaseId(result.name) ?? "未关联";
         const item = catalog.get(caseId);
-        const scriptPath = item?.scriptPath ?? inferredScriptPath(result.classname);
-        const details = result.details || result.message || "";
-        const failureCell = result.status === "passed"
-            ? "—"
-            : `<strong>${escapeHtml(result.message || humanStatus(result.status))}</strong>${details ? `<details><summary>查看完整技术详情</summary><pre>${escapeHtml(details)}</pre></details>` : ""}`;
-        return `<tr class="result-${result.status}"><td><code>${escapeHtml(caseId)}</code></td><td><strong>${escapeHtml(item?.title ?? result.name)}</strong><small>${escapeHtml(item?.scenario ?? "未从 Markdown 用例提取场景说明。")}</small></td><td><code>${escapeHtml(scriptPath)}</code><small>${escapeHtml(result.name)}</small></td><td><span class="status ${result.status}">${humanStatus(result.status)}</span></td><td>${formatDuration(result.durationMs)}</td><td>${failureCell}</td></tr>`;
+        const io = requestResponseSummary(result);
+        const failureDetail = result.status === "passed"
+            ? ""
+            : `<div class="failure-detail"><strong>${escapeHtml(result.message || humanStatus(result.status))}</strong>${result.details ? `<details><summary>失败详情</summary><pre>${escapeHtml(result.details)}</pre></details>` : ""}</div>`;
+        return `<article class="case-card result-${result.status}"><div class="case-head"><div><span class="case-id">${escapeHtml(caseId)}</span><h3>${escapeHtml(item?.title ?? result.name)}</h3><p>${escapeHtml(item?.scenario ?? "未从 Markdown 用例提取场景说明。")}</p></div><div class="case-outcome"><span class="status ${result.status}">${humanStatus(result.status)}</span><span class="duration">${formatDuration(result.durationMs)}</span></div></div><div class="case-meta"><span>自动化用例</span><code>${escapeHtml(result.name)}</code></div><div class="io-grid">${reportDetails("接口请求参数", io.requests, "本次 JUnit 未捕获请求日志。")}${reportDetails("接口响应结果", io.responses, "本次 JUnit 未捕获响应日志。")}</div>${failureDetail}</article>`;
     }).join("");
+    const caseValidation = parseAdvisorySummary(input.caseValidationSummary);
+    const traceability = parseAdvisorySummary(input.traceabilitySummary);
+    const failures = input.parsed.cases.filter((result) => result.status !== "passed");
+    const failureOverview = failures.length > 0
+        ? `<div class="failure-list">${failures.map((result) => {
+            const caseId = junitCaseId(result.name) ?? "未关联";
+            return `<article><div>${advisoryBadge(result.status === "skipped" ? "Unavailable" : "FAIL")}<strong>${escapeHtml(caseId)} · ${escapeHtml(catalog.get(caseId)?.title ?? result.name)}</strong></div><p>${escapeHtml(result.message || humanStatus(result.status))}</p></article>`;
+        }).join("")}</div>`
+        : '<div class="empty-state">本轮没有失败、错误或跳过用例。</div>';
     const conclusion = input.parsed.failed + input.parsed.errors === 0
         ? `本轮测试通过：${input.parsed.passed} 条用例执行成功。`
         : `本轮测试未通过：${input.parsed.failed + input.parsed.errors} 条用例失败或错误，请优先查看失败原因。`;
-    return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(input.title)}</title><style>:root{color-scheme:light;--ink:#172033;--muted:#667085;--line:#d9e2ec;--panel:#f7f9fc;--brand:#17365d;--pass:#067647;--pass-bg:#ecfdf3;--fail:#b42318;--fail-bg:#fef3f2;--skip:#9a6700;--skip-bg:#fffaeb}*{box-sizing:border-box}body{margin:0;background:#eef2f6;color:var(--ink);font-family:system-ui,"Microsoft YaHei","PingFang SC",sans-serif;line-height:1.6}header,main{max-width:1440px;margin:auto}header{padding:2.5rem 2rem 1.25rem}main{padding:0 2rem 3rem}h1{margin:.25rem 0;color:var(--brand)}h2{margin-top:2rem;color:var(--brand)}.eyebrow{color:var(--muted);font-weight:700}.banner{padding:1rem 1.25rem;border-radius:.75rem;background:${input.parsed.failed + input.parsed.errors === 0 ? "var(--pass-bg)" : "var(--fail-bg)"};color:${input.parsed.failed + input.parsed.errors === 0 ? "var(--pass)" : "var(--fail)"};font-weight:700}.cards{display:grid;grid-template-columns:repeat(6,minmax(7rem,1fr));gap:.75rem;margin:1rem 0}.card{padding:1rem;border:1px solid var(--line);border-radius:.75rem;background:white}.card span,small{display:block;color:var(--muted)}.card strong{font-size:1.55rem}section{background:white;border:1px solid var(--line);border-radius:.9rem;padding:1.25rem;margin-top:1rem;box-shadow:0 8px 24px rgba(23,54,93,.04)}.table-wrap{overflow:auto}table{width:100%;border-collapse:collapse;min-width:1100px}th,td{border-bottom:1px solid var(--line);padding:.75rem;text-align:left;vertical-align:top}th{background:var(--panel);position:sticky;top:0}.status{display:inline-block;padding:.15rem .55rem;border-radius:999px;font-weight:700}.status.passed{color:var(--pass);background:var(--pass-bg)}.status.failure,.status.error{color:var(--fail);background:var(--fail-bg)}.status.skipped{color:var(--skip);background:var(--skip-bg)}code{white-space:nowrap}pre{white-space:pre-wrap;max-height:22rem;overflow:auto;background:#101828;color:#f2f4f7;padding:1rem;border-radius:.5rem}details{margin-top:.5rem}summary{cursor:pointer;color:var(--brand);font-weight:700}.secondary{display:grid;grid-template-columns:1fr 1fr;gap:1rem}.secondary pre{background:var(--panel);color:var(--ink)}@media(max-width:900px){.cards{grid-template-columns:repeat(2,1fr)}.secondary{grid-template-columns:1fr}header,main{padding-left:1rem;padding-right:1rem}}</style></head><body><header><div class="eyebrow">后端自动化测试报告</div><h1>${escapeHtml(input.title)}</h1><p>主要面向测试、研发和评审人员；执行事实来自同一次 pytest JUnit。</p></header><main><section><h2>测试结论</h2><div class="banner">${escapeHtml(conclusion)}</div><div class="cards"><div class="card"><span>用例总数</span><strong>${input.parsed.tests}</strong></div><div class="card"><span>通过</span><strong>${input.parsed.passed}</strong></div><div class="card"><span>失败</span><strong>${input.parsed.failed}</strong></div><div class="card"><span>错误</span><strong>${input.parsed.errors}</strong></div><div class="card"><span>跳过</span><strong>${input.parsed.skipped}</strong></div><div class="card"><span>通过率 / 总耗时</span><strong>${(passRate * 100).toFixed(2)}%</strong><small>${formatDuration(input.parsed.durationMs)}</small></div></div></section><section><h2>用例执行结果</h2><div class="table-wrap"><table><thead><tr><th>用例编号</th><th>用例名称及测试场景</th><th>自动化脚本</th><th>结果</th><th>耗时</th><th>失败原因</th></tr></thead><tbody>${rows || '<tr><td colspan="6">未发现可展示的 JUnit testcase。</td></tr>'}</tbody></table></div></section><section><h2>执行证据</h2><div class="secondary"><details><summary>环境信息</summary><pre>${escapeHtml(input.environmentSummary.slice(0, 8000))}</pre></details><details><summary>用例追溯信息</summary><pre>${escapeHtml(input.traceabilitySummary.slice(0, 8000))}</pre></details></div></section></main></body></html>`;
+    return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(input.title)}</title><style>:root{color-scheme:light;--ink:#182230;--muted:#667085;--line:#dce3ec;--panel:#f6f8fb;--brand:#163a63;--accent:#2e6da4;--pass:#067647;--pass-bg:#ecfdf3;--fail:#b42318;--fail-bg:#fef3f2;--skip:#9a6700;--skip-bg:#fffaeb;--shadow:0 18px 45px rgba(28,55,90,.09)}*{box-sizing:border-box}body{margin:0;background:radial-gradient(circle at top left,#dcecff 0,transparent 32rem),linear-gradient(180deg,#edf3fa 0,#f8fafc 34rem);color:var(--ink);font-family:Inter,system-ui,"Microsoft YaHei","PingFang SC",sans-serif;line-height:1.65}header,main{max-width:1280px;margin:auto}header{padding:3.5rem 2rem 1.75rem}main{padding:0 2rem 4rem}h1{margin:.3rem 0;color:var(--brand);font-size:clamp(2rem,4vw,3rem);letter-spacing:-.03em}h2{margin:0 0 1rem;color:var(--brand)}h3{margin:.35rem 0 .15rem;font-size:1.12rem}.eyebrow{color:var(--accent);font-weight:850;letter-spacing:.12em}.subtitle,.muted,.case-head p{color:var(--muted)}section{background:rgba(255,255,255,.94);border:1px solid rgba(220,227,236,.95);border-radius:1.15rem;padding:1.5rem;margin-top:1rem;box-shadow:var(--shadow)}.banner{padding:1rem 1.25rem;border-left:5px solid currentColor;border-radius:.8rem;background:${input.parsed.failed + input.parsed.errors === 0 ? "var(--pass-bg)" : "var(--fail-bg)"};color:${input.parsed.failed + input.parsed.errors === 0 ? "var(--pass)" : "var(--fail)"};font-weight:800}.cards{display:grid;grid-template-columns:repeat(6,minmax(7rem,1fr));gap:.75rem;margin-top:1rem}.card,.quality-card{padding:1rem;border:1px solid var(--line);border-radius:.85rem;background:white}.card span,.card small{display:block;color:var(--muted)}.card strong{font-size:1.55rem}.quality-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:1rem}.quality-card header{display:flex;align-items:center;justify-content:space-between;padding:0;margin:0 0 .5rem}.quality-card p{margin:.25rem 0;color:var(--muted)}.status{display:inline-flex;align-items:center;padding:.18rem .62rem;border-radius:999px;font-weight:800;font-size:.86rem}.status.passed{color:var(--pass);background:var(--pass-bg)}.status.failure,.status.error{color:var(--fail);background:var(--fail-bg)}.status.skipped{color:var(--skip);background:var(--skip-bg)}.failure-list{display:grid;gap:.75rem}.failure-list article{border-left:4px solid var(--fail);background:var(--fail-bg);padding:.85rem 1rem;border-radius:.65rem}.empty-state{padding:1rem;border:1px dashed var(--line);border-radius:.75rem;color:var(--muted);background:var(--panel)}.case-list{display:grid;gap:1rem}.case-card{border:1px solid var(--line);border-radius:1rem;padding:1.15rem;background:linear-gradient(145deg,#fff,#fbfcfe);box-shadow:0 8px 24px rgba(28,55,90,.06)}.case-card.result-failure,.case-card.result-error{border-left:5px solid var(--fail)}.case-card.result-passed{border-left:5px solid var(--pass)}.case-head{display:flex;justify-content:space-between;gap:1rem;align-items:flex-start}.case-head p{margin:.2rem 0}.case-id{display:inline-block;color:var(--accent);font-weight:850;letter-spacing:.04em}.case-outcome{display:flex;align-items:center;gap:.75rem;white-space:nowrap}.duration{color:var(--muted);font-variant-numeric:tabular-nums}.case-meta{display:flex;gap:.75rem;align-items:center;margin:.85rem 0;padding:.65rem .8rem;border-radius:.7rem;background:var(--panel);color:var(--muted)}code{color:var(--brand);font-weight:700}.io-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:.8rem}.io-details{border:1px solid var(--line);border-radius:.75rem;padding:.7rem;background:white}.io-details summary{cursor:pointer;color:var(--brand);font-weight:800}.io-details summary span{float:right;color:var(--muted)}pre{white-space:pre-wrap;overflow-wrap:anywhere;max-height:18rem;overflow:auto;background:#101828;color:#eef4ff;padding:.85rem;border-radius:.6rem;font-size:.82rem}.failure-detail{margin-top:.8rem;padding:.8rem;border-radius:.7rem;background:var(--fail-bg);color:var(--fail)}details summary{cursor:pointer}.subtitle{margin:.2rem 0 0}@media(max-width:900px){.cards{grid-template-columns:repeat(2,1fr)}.quality-grid,.io-grid{grid-template-columns:1fr}.case-head{display:block}.case-outcome{margin-top:.65rem}header,main{padding-left:1rem;padding-right:1rem}}</style></head><body><header><div class="eyebrow">后端自动化测试报告</div><h1>${escapeHtml(input.title)}</h1><p class="subtitle">测试结论、质量状态与每条接口用例的请求/响应事实均来自同一次 pytest 执行。</p></header><main><section><h2>测试结论</h2><div class="banner">${escapeHtml(conclusion)}</div><div class="cards"><div class="card"><span>用例总数</span><strong>${input.parsed.tests}</strong></div><div class="card"><span>通过</span><strong>${input.parsed.passed}</strong></div><div class="card"><span>失败</span><strong>${input.parsed.failed}</strong></div><div class="card"><span>错误</span><strong>${input.parsed.errors}</strong></div><div class="card"><span>跳过</span><strong>${input.parsed.skipped}</strong></div><div class="card"><span>通过率 / 总耗时</span><strong>${(passRate * 100).toFixed(2)}%</strong><small>${formatDuration(input.parsed.durationMs)}</small></div></div></section><section><h2>质量校验</h2><div class="quality-grid"><div class="quality-card"><header><strong>Markdown 用例校验</strong>${advisoryBadge(caseValidation.status)}</header><p>Findings：${caseValidation.findings ?? "不可用"}</p><p>${escapeHtml(caseValidation.firstFinding)}</p></div><div class="quality-card"><header><strong>Markdown → pytest 追溯</strong>${advisoryBadge(traceability.status)}</header><p>Findings：${traceability.findings ?? "不可用"}</p><p>${escapeHtml(traceability.firstFinding)}</p></div></div></section><section><h2>失败概览</h2>${failureOverview}</section><section><h2>用例执行结果</h2><div class="case-list">${rows || '<div class="empty-state">未发现可展示的 JUnit testcase。</div>'}</div></section></main></body></html>`;
 }
 export function renderBackendTestFacts(input) {
     const passRate = input.parsed.tests > 0 ? input.parsed.passed / input.parsed.tests : 0;
+    const caseValidation = parseAdvisorySummary(input.caseValidationSummary);
+    const traceability = parseAdvisorySummary(input.traceabilitySummary);
+    const catalog = new Map((input.cases ?? []).map((entry) => [entry.id, entry]));
     return ([
-        "# 后端测试执行事实",
+        "# 后端自动化测试执行报告",
         "",
-        "## 执行摘要",
+        `> ${input.pytestExitCode === 0 ? `本轮 ${input.parsed.passed}/${input.parsed.tests} 条用例通过。` : `本轮有 ${input.parsed.failed + input.parsed.errors} 条失败或错误，请查看失败概览。`}`,
+        "",
+        "## 测试概览",
+        "",
+        "| 状态 | 总数 | 通过 | 失败 | 错误 | 跳过 | 通过率 | 总耗时 |",
+        "|---|---:|---:|---:|---:|---:|---:|---:|",
+        `| ${input.pytestExitCode === 0 ? "通过" : "未通过"} | ${input.parsed.tests} | ${input.parsed.passed} | ${input.parsed.failed} | ${input.parsed.errors} | ${input.parsed.skipped} | ${(passRate * 100).toFixed(2)}% | ${formatDuration(input.parsed.durationMs)} |`,
         "",
-        `- Status: ${input.pytestExitCode === 0 ? "passed" : "completed-with-failures"}`,
         `- Pytest exit code: ${input.pytestExitCode}`,
-        `- Duration: ${input.parsed.durationMs ?? "unavailable"} ms`,
         "- JUnit valid: yes",
         "- HTML valid: yes",
         "",
-        "## 计数",
+        "## 质量校验",
+        "",
+        "| 校验项 | 状态 | Findings | 首要发现 |",
+        "|---|---|---:|---|",
+        `| Markdown 用例校验 | ${caseValidation.status} | ${caseValidation.findings ?? "不可用"} | ${caseValidation.firstFinding.replaceAll("|", "\\|")} |`,
+        `| Markdown → pytest 追溯 | ${traceability.status} | ${traceability.findings ?? "不可用"} | ${traceability.firstFinding.replaceAll("|", "\\|")} |`,
         "",
-        `- Total: ${input.parsed.tests}`,
-        `- Passed: ${input.parsed.passed}`,
-        `- Failed: ${input.parsed.failed}`,
-        `- Errors: ${input.parsed.errors}`,
-        `- Skipped: ${input.parsed.skipped}`,
-        `- Pass rate: ${(passRate * 100).toFixed(2)}%`,
+        "## 失败概览",
         "",
-        "## 逐条执行结果",
+        ...(input.parsed.failures.length > 0
+            ? input.parsed.failures.map((failure) => `- **${failure.name}** · ${failure.kind}: ${failure.message}`)
+            : ["- 无失败或错误用例。"]),
+        "",
+        "## 用例执行明细",
         "",
         "| 用例编号 | 用例名称 | 自动化脚本 | 测试函数 | 结果 | 耗时 | 失败原因 |",
         "|---|---|---|---|---|---:|---|",
         ...input.parsed.cases.map((result) => {
             const caseId = junitCaseId(result.name) ?? "未关联";
-            const item = new Map((input.cases ?? []).map((entry) => [entry.id, entry])).get(caseId);
+            const item = catalog.get(caseId);
             const script = item?.scriptPath ?? inferredScriptPath(result.classname);
             return `| ${caseId} | ${item?.title ?? result.name} | \`${script}\` | \`${result.name}\` | ${humanStatus(result.status)} | ${formatDuration(result.durationMs)} | ${(result.message ?? "—").replaceAll("|", "\\|")} |`;
         }),
         "",
-        "## 证据",
+        "## 证据与完整校验原文",
         "",
         `- JUnit: ${input.junitRelativePath}`,
         `- JUnit SHA-256: ${createHash("sha256").update(input.junitContent).digest("hex")}`,
         `- HTML: ${input.htmlRelativePath}`,
         `- HTML SHA-256: ${createHash("sha256").update(input.htmlContent).digest("hex")}`,
         "",
-        "## 失败用例",
+        "<details>",
+        "<summary>Markdown 用例校验原文</summary>",
         "",
-        ...(input.parsed.failures.length > 0
-            ? input.parsed.failures.map((failure) => `- ${failure.name} [${failure.kind}]: ${failure.message}`)
-            : ["- None"]),
+        input.caseValidationSummary?.trim() ?? "Unavailable",
+        "",
+        "</details>",
+        "",
+        "<details>",
+        "<summary>Markdown → pytest 追溯原文</summary>",
+        "",
+        input.traceabilitySummary?.trim() ?? "Unavailable",
+        "",
+        "</details>",
         "",
         "## 成熟度证据",
         "",

package/dist/workflows/dag/backend-test-result-contract.js

@@ -231,6 +231,12 @@ export function parseJunitXml(xml) {
         const failureTag = body.match(/<failure\b([^>]*)>([\s\S]*?)<\/failure>|<failure\b([^>]*)\/>/i);
         const errorTag = body.match(/<error\b([^>]*)>([\s\S]*?)<\/error>|<error\b([^>]*)\/>/i);
         const skippedTag = /<skipped\b/i.test(body);
+        const caseStdout = body.match(/<system-out\b[^>]*>([\s\S]*?)<\/system-out>/i)?.[1];
+        const caseStderr = body.match(/<system-err\b[^>]*>([\s\S]*?)<\/system-err>/i)?.[1];
+        const capturedOutput = {
+            ...(caseStdout ? { stdout: decodeXmlEntities(caseStdout).trim() } : {}),
+            ...(caseStderr ? { stderr: decodeXmlEntities(caseStderr).trim() } : {}),
+        };
         if (failureTag) {
             caseFailed += 1;
             const fAttrs = failureTag[1] ?? failureTag[3] ?? "";
@@ -243,7 +249,7 @@ export function parseJunitXml(xml) {
                 message: summary,
                 kind: "failure",
             });
-            cases.push({ classname, name, durationMs: caseDurationMs, status: "failure", message: summary, details: fBody || summary });
+            cases.push({ classname, name, durationMs: caseDurationMs, status: "failure", message: summary, details: fBody || summary, ...capturedOutput });
         }
         else if (errorTag) {
             caseErrors += 1;
@@ -257,16 +263,16 @@ export function parseJunitXml(xml) {
                 message: summary,
                 kind: "error",
             });
-            cases.push({ classname, name, durationMs: caseDurationMs, status: "error", message: summary, details: eBody || summary });
+            cases.push({ classname, name, durationMs: caseDurationMs, status: "error", message: summary, details: eBody || summary, ...capturedOutput });
         }
         else if (skippedTag) {
             caseSkipped += 1;
             const skippedAttrs = body.match(/<skipped\b([^>]*)/i)?.[1] ?? "";
             const message = attr(skippedAttrs, "message");
-            cases.push({ classname, name, durationMs: caseDurationMs, status: "skipped", ...(message ? { message } : {}) });
+            cases.push({ classname, name, durationMs: caseDurationMs, status: "skipped", ...(message ? { message } : {}), ...capturedOutput });
         }
         else {
-            cases.push({ classname, name, durationMs: caseDurationMs, status: "passed" });
+            cases.push({ classname, name, durationMs: caseDurationMs, status: "passed", ...capturedOutput });
         }
         match = caseRe.exec(trimmed);
     }