@tea-agent/loop-agent 0.44.0-next.10 → 0.44.0-next.11

package/dist/workflows/dag/hybrid/sources.js

@@ -0,0 +1,1812 @@
+/** DAG hybrid 输入准备：来源装载、Mock discovery、verification 规划与 source binding。禁止 import 模板分发入口。 */
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { access, readFile, readdir, realpath } from "node:fs/promises";
+import { existsSync, readFileSync } from "node:fs";
+import { DAG_AGENT_RUNTIME_PI_ONLY, DAG_REPAIR_WRITER_PROTOCOL_EXPLICIT_NODE_V1, DAG_RUNTIME_CONTRACT_SCHEMA_VERSION } from "../types.js";
+import { planMavenVerification } from "../../../verification/maven/index.js";
+import { pathMatchesPattern } from "../../../shared/git-progress.js";
+import { BASELINE_FORBIDDEN_PATHS } from "../governance-constants.js";
+import { resolveAdapter } from "../../../adapters/index.js";
+import { loadHarnessManifest } from "../../../governance/harness.js";
+import { mergeDocumentIndexCompanions } from "../../../governance/document-index-closure.js";
+import { probeRepoLocalSddSkills } from "../sdd-embedded.js";
+import { discoverProjectGovernancePresence } from "../project-governance-context.js";
+import { CANONICAL_TASK_ID_PATTERN, getTaskPaths, loadTaskConfig } from "../../../task/runtime.js";
+import { materializeTaskReferenceDocs } from "../../../task/source-references.js";
+import { extractRequirementFactsFromMarkdown } from "../../../task/source-prepare/parse-intent.js";
+import { computeLedgerInputDigest, parseLedgerJson, recoverLedgerInputContract, validateRequirementLedger } from "../../../task/source-prepare/ledger.js";
+import { REQUIREMENT_LEDGER_FILE_NAME } from "../../../task/contract/constants.js";
+import { resolveVerifyPreset } from "../../../executors/shell-verification.js";
+import { resolveExecutorModelMatrices } from "../../../executors/model-routing.js";
+import { normalizeTaskRequirementText } from "../task-demand-routing.js";
+import { classifyFrontendRisk } from "../frontend-risk.js";
+import { discoverFrontendProjectCapability } from "../frontend-project-capability.js";
+import { classifyFrontendVerifyCommandText, isRecognizedFrontendVerifyCommandText } from "../frontend-implementation-contract.js";
+import { computeFrontendShapeSourceDigest } from "../frontend-shape.js";
+import { discoverLatestCommittedFrontendShapeCapsule } from "../frontend-shape-capsule-store.js";
+import { serializeDagTaskSourcePath } from "../../../task/dag-source-paths.js";
+import { resolveEnabledExecutors, } from "./types.js";
+export const HYBRID_DEFAULTS = {
+    executor: "pi",
+    piBackend: "sdk-first",
+    contextProfile: "slim",
+    skills: ["ai-engineering-context"],
+    writePolicy: "read-only",
+};
+export const HYBRID_SKILLS_BY_ROLE = {
+    planner: ["loop-agent"],
+    scout: ["ai-engineering-context", "codebase-scout"],
+    implementer: ["test-driven-development", "verification-before-completion"],
+    reviewer: ["requesting-code-review", "code-review-core"],
+    verifier: ["verification-before-completion", "systematic-debugging"],
+    closeout: ["loop-agent", "verification-before-completion"],
+};
+export const FRONTEND_DEFAULTS = {
+    ...HYBRID_DEFAULTS,
+    skills: [],
+};
+export const FRONTEND_SKILLS_BY_ROLE = {
+    planner: [],
+    scout: [],
+    implementer: [],
+    reviewer: [],
+    supervisor: [],
+    verifier: [],
+    closeout: [],
+};
+export const FRONTEND_CONTRACT_SKILLS = ["frontend-contract"];
+export const FRONTEND_SCOUT_SKILLS = ["frontend-scout"];
+export const FRONTEND_PLAN_SKILLS = ["frontend-plan"];
+export const FRONTEND_BOUNDED_IMPLEMENT_SKILLS = ["frontend-bounded-implement"];
+export const FRONTEND_DESIGN_REVIEW_SKILLS = ["frontend-design-review"];
+export const FRONTEND_REVIEW_SKILLS = ["frontend-review"];
+export const FRONTEND_VERIFICATION_SKILLS = ["frontend-verification"];
+export const IMPLEMENT_WRITESET_PLACEHOLDER = "REPLACE/WITH/NARROW/IMPLEMENT/PATHS/**";
+export const GENERATED_DAG_RUNTIME_CONTRACT = {
+    schemaVersion: DAG_RUNTIME_CONTRACT_SCHEMA_VERSION,
+    agentRuntime: DAG_AGENT_RUNTIME_PI_ONLY,
+    repairWriterProtocol: DAG_REPAIR_WRITER_PROTOCOL_EXPLICIT_NODE_V1,
+};
+export const STANDARD_GLOBAL_CONSTRAINTS = [
+    "Do not commit runtime traces under .harness/dag-runs/",
+    "Do not enable cross-node Pi runtime reuse by default",
+    "Preserve CODE_AGENT_PI_BACKEND=cli-only rollback for Pi nodes",
+    "Same-rank exclusive writeSet entries must be disjoint",
+    "Every task must explicitly declare executor; defaults.executor is schema-only and not a runtime fallback",
+    "Prefer same-rank parallel read-only scouts over serial chains when outputs are independent",
+    "If the DAG is a single linear chain, challenge whether read-only work can run in parallel ranks",
+    "Read-only DAG nodes must not write repository files, including root artifacts/**; return findings in node output only",
+    "Root artifacts/ is reserved for explicit exclusive write nodes, not read-only scout/reviewer output",
+    "exclusive implementer nodes must use narrow, concrete writeSet paths; never keep ** or repo root",
+    `Replace ${IMPLEMENT_WRITESET_PLACEHOLDER} with concrete paths before executing the implementation writer`,
+];
+export async function packageJsonHasMockScript(repoRoot) {
+    try {
+        const raw = await readFile(path.join(repoRoot, "package.json"), "utf-8");
+        const pkg = JSON.parse(raw);
+        const scripts = pkg.scripts ?? {};
+        const mockScripts = Object.keys(scripts).filter((name) => name === "mock" ||
+            name.startsWith("mock:") ||
+            name.startsWith("dev:mock") ||
+            /mock/i.test(name));
+        const verifyCommands = mockScripts
+            .filter((name) => /(?:test|check|verify|contract)/i.test(name))
+            .map((name) => ({
+            label: `npm run ${name}`,
+            args: ["npm", "run", name],
+            cwd: repoRoot,
+        }));
+        return {
+            hasScript: mockScripts.length > 0,
+            scriptNames: mockScripts,
+            verifyCommands,
+        };
+    }
+    catch {
+        return { hasScript: false, scriptNames: [], verifyCommands: [] };
+    }
+}
+export async function hasDirectDependency(repoRoot, depName) {
+    try {
+        const raw = await readFile(path.join(repoRoot, "package.json"), "utf-8");
+        const pkg = JSON.parse(raw);
+        const deps = {
+            ...(pkg.dependencies ?? {}),
+            ...(pkg.devDependencies ?? {}),
+        };
+        return depName in deps;
+    }
+    catch {
+        return false;
+    }
+}
+export async function collectDeclaredDependencies(repoRoot) {
+    try {
+        const raw = await readFile(path.join(repoRoot, "package.json"), "utf-8");
+        const pkg = JSON.parse(raw);
+        return [
+            ...Object.keys(pkg.dependencies ?? {}),
+            ...Object.keys(pkg.devDependencies ?? {}),
+        ];
+    }
+    catch {
+        return [];
+    }
+}
+export async function discoverMockHandlerFiles(repoRoot, serviceRoot) {
+    const exactCandidates = [
+        ...[
+            "src/mocks/handlers.ts",
+            "src/mocks/handlers.js",
+            "src/mocks/browser.ts",
+            "src/mocks/browser.js",
+            "src/mocks/server.ts",
+            "src/mocks/server.js",
+            "mocks/handlers.ts",
+            "mocks/handlers.js",
+            "mocks/browser.ts",
+            "mocks/browser.js",
+        ].map((candidatePath) => ({ framework: "msw", path: candidatePath })),
+        ...["db.json", "mock/db.json", "src/mock/db.json"].map((candidatePath) => ({
+            framework: "json-server",
+            path: candidatePath,
+        })),
+    ];
+    const directoryCandidates = [
+        ...(serviceRoot ? [{ path: serviceRoot }] : []),
+        { framework: "mockjs", path: "src/mock" },
+        { framework: "mockjs", path: "mock" },
+        { framework: "msw", path: "src/mocks" },
+        { framework: "msw", path: "mocks" },
+        { framework: "mirage", path: "src/mirage" },
+        { framework: "mirage", path: "mirage" },
+    ];
+    const foundPaths = new Set();
+    let foundFramework;
+    for (const candidate of exactCandidates) {
+        try {
+            await access(path.join(repoRoot, candidate.path));
+            foundPaths.add(candidate.path);
+            foundFramework ??= candidate.framework;
+        }
+        catch {
+            // Exact candidate does not exist.
+        }
+    }
+    async function collectFiles(directory, relativeDirectory) {
+        let entries;
+        try {
+            entries = await readdir(directory, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (foundPaths.size >= 24)
+                return;
+            const absoluteEntry = path.join(directory, entry.name);
+            const relativeEntry = path.posix.join(relativeDirectory.replace(/\\/g, "/"), entry.name);
+            if (entry.isDirectory()) {
+                await collectFiles(absoluteEntry, relativeEntry);
+            }
+            else if (entry.isFile()) {
+                foundPaths.add(relativeEntry);
+            }
+        }
+    }
+    for (const candidate of directoryCandidates) {
+        const before = foundPaths.size;
+        await collectFiles(path.join(repoRoot, candidate.path), candidate.path);
+        if (foundPaths.size > before && candidate.framework) {
+            foundFramework ??= candidate.framework;
+        }
+    }
+    return { framework: foundFramework, paths: [...foundPaths].sort() };
+}
+export async function discoverMockBootstrapImports(repoRoot) {
+    const entryCandidates = [
+        "src/main.ts",
+        "src/main.tsx",
+        "src/main.js",
+        "src/main.jsx",
+        "src/index.ts",
+        "src/index.tsx",
+        "src/index.js",
+        "src/index.jsx",
+        "src/setupTests.ts",
+        "src/setupTests.js",
+        "test/setup.ts",
+        "test/setup.js",
+    ];
+    const imports = [];
+    for (const candidate of entryCandidates) {
+        try {
+            const content = await readFile(path.join(repoRoot, candidate), "utf-8");
+            if (/(?:from\s*|import\s*)["'][^"']*(?:mock|msw|mirage)[^"']*["']/i.test(content)) {
+                imports.push(candidate);
+            }
+        }
+        catch {
+            // Candidate entry does not exist or is unreadable.
+        }
+    }
+    return imports;
+}
+export async function discoverFrontendMockCapability(repoRoot, taskConfig) {
+    const safetyViolation = await frontendMockServiceRootSafetyViolation(repoRoot, taskConfig);
+    if (safetyViolation) {
+        return {
+            status: "ambiguous",
+            serviceRoot: taskConfig.frontendMock?.serviceRoot,
+            safetyViolation,
+            evidencePaths: [],
+            verifyCommands: [],
+            reasons: [safetyViolation],
+        };
+    }
+    const evidencePaths = [];
+    const reasons = [];
+    let framework;
+    let serviceRoot;
+    let strongEvidenceCount = 0;
+    let ambiguousSignals = 0;
+    // 1. Check package.json mock scripts
+    const scriptResult = await packageJsonHasMockScript(repoRoot);
+    if (scriptResult.hasScript) {
+        reasons.push(`package.json has mock scripts: ${scriptResult.scriptNames.join(", ")}`);
+        evidencePaths.push("package.json");
+        // A script alone is not strong evidence unless we also find config/entry
+    }
+    // 2. Check for direct mock framework dependencies
+    const mockDeps = [
+        "msw",
+        "mockjs",
+        "miragejs",
+        "json-server",
+        "vite-plugin-mock",
+    ];
+    const foundDeps = [];
+    for (const dep of mockDeps) {
+        if (await hasDirectDependency(repoRoot, dep)) {
+            foundDeps.push(dep);
+            evidencePaths.push(`package.json (${dep})`);
+        }
+    }
+    // 3. Check for handler/fixture/bootstrap files
+    const serviceRootHint = taskConfig.frontendMock?.serviceRoot;
+    const handlerResult = await discoverMockHandlerFiles(repoRoot, serviceRootHint);
+    const bootstrapImports = await discoverMockBootstrapImports(repoRoot);
+    if (handlerResult.framework) {
+        framework = handlerResult.framework;
+    }
+    if (handlerResult.paths.length > 0) {
+        evidencePaths.push(...handlerResult.paths);
+        reasons.push(`Mock handler/fixture paths found: ${handlerResult.paths.join(", ")}`);
+    }
+    if (bootstrapImports.length > 0) {
+        evidencePaths.push(...bootstrapImports);
+        reasons.push(`Application/test bootstrap imports Mock code: ${bootstrapImports.join(", ")}`);
+    }
+    // Evaluate strong evidence
+    // Case: direct dep + handler files
+    if (foundDeps.length > 0 && handlerResult.paths.length > 0) {
+        strongEvidenceCount++;
+        reasons.push(`Direct mock dependency (${foundDeps.join(", ")}) with handler files`);
+    }
+    // Case: mock script in package.json + corresponding config/entry
+    if (scriptResult.hasScript && handlerResult.paths.length > 0) {
+        strongEvidenceCount++;
+        reasons.push("Mock scripts and handler files both present");
+    }
+    if (bootstrapImports.length > 0 && handlerResult.paths.length > 0) {
+        strongEvidenceCount++;
+        reasons.push("Application/test bootstrap and project Mock files both present");
+    }
+    // Case: project specs define mock service root
+    if (taskConfig.frontendMock?.serviceRoot && handlerResult.paths.length > 0) {
+        strongEvidenceCount++;
+        serviceRoot = taskConfig.frontendMock.serviceRoot;
+        reasons.push(`task config specifies serviceRoot=${serviceRoot}`);
+    }
+    // Handle ambiguous: some signals but not enough for "present"
+    if (strongEvidenceCount === 0 &&
+        (foundDeps.length > 0 ||
+            scriptResult.hasScript ||
+            handlerResult.paths.length > 0 ||
+            bootstrapImports.length > 0)) {
+        ambiguousSignals++;
+        if (foundDeps.length > 0 && handlerResult.paths.length === 0) {
+            reasons.push(`Mock dependency found (${foundDeps.join(", ")}) but no handler/bootstrap files detected`);
+        }
+        if (scriptResult.hasScript &&
+            handlerResult.paths.length === 0 &&
+            foundDeps.length === 0) {
+            reasons.push("Mock scripts exist but no handler files or direct mock dependencies found");
+        }
+    }
+    // Build verify commands from task config
+    const configuredVerifyCommands = (taskConfig.frontendMock?.verifyCommands ?? []).map((cmd) => ({
+        label: cmd.label,
+        args: ["bash", "-lc", cmd.command],
+        cwd: repoRoot,
+        timeoutMs: cmd.timeoutMs,
+    }));
+    const verifyCommands = [
+        ...configuredVerifyCommands,
+        ...scriptResult.verifyCommands,
+    ].filter((command, index, commands) => commands.findIndex((candidate) => candidate.label === command.label) ===
+        index);
+    if (strongEvidenceCount > 0) {
+        return {
+            status: "present",
+            framework,
+            serviceRoot: serviceRoot ?? taskConfig.frontendMock?.serviceRoot,
+            evidencePaths,
+            verifyCommands,
+            reasons,
+        };
+    }
+    if (ambiguousSignals > 0) {
+        return {
+            status: "ambiguous",
+            framework,
+            serviceRoot: taskConfig.frontendMock?.serviceRoot,
+            evidencePaths,
+            verifyCommands,
+            reasons,
+        };
+    }
+    return {
+        status: "absent",
+        evidencePaths,
+        verifyCommands,
+        reasons: ["No mock service evidence found in project"],
+    };
+}
+export function frontendMockServiceRootAllowed(taskConfig) {
+    const serviceRoot = taskConfig.frontendMock?.serviceRoot;
+    if (!serviceRoot)
+        return true;
+    const normalized = serviceRoot.replace(/\\/g, "/").replace(/^\.\//, "");
+    if (normalized === "." ||
+        normalized === ".." ||
+        normalized.startsWith("../") ||
+        path.isAbsolute(serviceRoot) ||
+        /[?*]/.test(normalized)) {
+        return false;
+    }
+    const allowed = taskConfig.allowedPaths.some((allowedPath) => pathMatchesPattern(normalized, allowedPath) ||
+        pathMatchesPattern(`${normalized}/_probe_`, allowedPath));
+    if (!allowed)
+        return false;
+    return !mergeForbiddenPaths(taskConfig).some((forbiddenPath) => {
+        const forbiddenPrefix = patternStaticPrefix(forbiddenPath);
+        return (pathMatchesPattern(normalized, forbiddenPath) ||
+            (forbiddenPrefix.length > 0 &&
+                pathMatchesPattern(forbiddenPrefix, normalized)));
+    });
+}
+export async function frontendMockServiceRootSafetyViolation(repoRoot, taskConfig) {
+    const serviceRoot = taskConfig.frontendMock?.serviceRoot;
+    if (!serviceRoot)
+        return undefined;
+    if (!frontendMockServiceRootAllowed(taskConfig)) {
+        return `frontendMock.serviceRoot is outside allowedPaths or overlaps forbiddenPaths: ${serviceRoot}`;
+    }
+    try {
+        const [repoRealPath, serviceRealPath] = await Promise.all([
+            realpath(repoRoot),
+            realpath(path.resolve(repoRoot, serviceRoot)),
+        ]);
+        const relativeRealPath = path.relative(repoRealPath, serviceRealPath);
+        if (relativeRealPath === ".." ||
+            relativeRealPath.startsWith(`..${path.sep}`) ||
+            path.isAbsolute(relativeRealPath)) {
+            return `frontendMock.serviceRoot resolves outside the repository: ${serviceRoot}`;
+        }
+        const normalizedRealPath = relativeRealPath.split(path.sep).join("/") || ".";
+        if (!frontendMockServiceRootAllowed({
+            ...taskConfig,
+            frontendMock: {
+                ...(taskConfig.frontendMock ?? {
+                    policy: "auto",
+                    verifyCommands: [],
+                }),
+                serviceRoot: normalizedRealPath,
+            },
+        })) {
+            return `frontendMock.serviceRoot resolves outside its allowed boundary: ${serviceRoot}`;
+        }
+    }
+    catch (error) {
+        // A missing configured root is capability absence, not a path escape. The
+        // discovery pass below will report it without traversing another location.
+        if (error.code !== "ENOENT") {
+            return `frontendMock.serviceRoot safety could not be verified: ${serviceRoot}`;
+        }
+    }
+    return undefined;
+}
+export function hasApiDependency(sources) {
+    if (sources.taskConfig.frontendMock?.policy === "required") {
+        return true;
+    }
+    const requirement = normalizeTaskRequirementText(sources.requirementMarkdown).replace(/`[^`\n]*`/g, " ");
+    const dependencyPatterns = [
+        /(?:接口文档|接口定义|接口协议|后端接口|服务端接口|接口联调|请求|响应|远程数据|异步数据|数据获取|模拟接口|模拟数据)/,
+        /(?<![A-Za-z0-9_])API(?![A-Za-z0-9_])/i,
+        /\b(?:endpoint|request|response|fetch|axios|schema|mock|backend\s+api|server\s+api)\b/i,
+    ];
+    const negationPatterns = [
+        /(?:不涉及|无需|不需要|不依赖|不调用|不请求|没有|禁止|不得).{0,16}(?:接口|后端|服务端|远程数据|异步数据|API)/i,
+        /\b(?:no|without|does\s+not|do\s+not|must\s+not)\b.{0,24}\b(?:api|endpoint|request|backend|server)\b/i,
+    ];
+    return requirement
+        .split(/[。！？!?；;，,\r\n]+/)
+        .map((clause) => clause.trim())
+        .filter(Boolean)
+        .some((clause) => !negationPatterns.some((pattern) => pattern.test(clause)) &&
+        dependencyPatterns.some((pattern) => pattern.test(clause)));
+}
+export function frontendSourceMentionsMock(sources) {
+    const text = [sources.requirementMarkdown, sources.constraintMarkdown]
+        .filter((entry) => typeof entry === "string" && entry.trim().length > 0)
+        .map((entry) => normalizeTaskRequirementText(entry).replace(/`[^`\n]*`/g, " "))
+        .join("\n");
+    const signalPatterns = [
+        /mock/i,
+        /模拟服务/,
+        /接口桩/,
+        /\bmsw\b/i,
+        /(?<![A-Za-z0-9_])API(?![A-Za-z0-9_])/i,
+        /接口/,
+    ];
+    const negationPatterns = [
+        /(?:不涉及|无需|不需要|不依赖|不调用|不请求|不实现|没有|禁止|不得).{0,16}(?:接口|后端|服务端|远程数据|异步数据|API|mock|模拟|桩)/i,
+        /\b(?:no|without|does\s+not|do\s+not|must\s+not)\b.{0,24}\b(?:api|endpoint|request|backend|server|mock)\b/i,
+    ];
+    return text
+        .split(/[。！？!?；;，,\r\n]+/)
+        .map((clause) => clause.trim())
+        .filter(Boolean)
+        .some((clause) => !negationPatterns.some((pattern) => pattern.test(clause)) &&
+        signalPatterns.some((pattern) => pattern.test(clause)));
+}
+export function resolveFrontendMockMode(capability, taskConfig, hasApiDep) {
+    const policy = taskConfig.frontendMock?.policy ?? "auto";
+    const hasDeterministicMockVerification = capability.verifyCommands.length > 0;
+    if (capability.safetyViolation ||
+        !frontendMockServiceRootAllowed(taskConfig)) {
+        return "blocked";
+    }
+    // disabled policy: must respect project mock rules (can't override spec)
+    if (policy === "disabled") {
+        // When disabled but the project spec mandates mock, it's blocked
+        if (capability.status === "present") {
+            // Project has mock service; disabled is an explicit override that still allows not-required
+            return "not-required";
+        }
+        return "not-required";
+    }
+    // required policy
+    if (policy === "required") {
+        if (capability.status === "present" && hasDeterministicMockVerification) {
+            return "required";
+        }
+        return "blocked";
+    }
+    // auto policy
+    if (!hasApiDep) {
+        return "not-required";
+    }
+    // In auto mode, frontend Mock is optional. Only enter Mock-backed "required"
+    // mode when the project has a confirmed native Mock capability AND
+    // deterministic Mock verification commands. Without executable verification
+    // commands a non-not-needed strategy could never be verified, so auto falls
+    // back to not-required; the prewrite gate then forces not-needed and the
+    // plan records the Real Integration Gap instead of inventing commands.
+    return capability.status === "present" && hasDeterministicMockVerification
+        ? "required"
+        : "not-required";
+}
+export function excerptMarkdown(content, options = {}) {
+    const maxChars = options.maxChars ?? MAX_SOURCE_EXCERPT_CHARS;
+    const trimmed = content.trim();
+    if (trimmed.length <= maxChars) {
+        return {
+            text: trimmed,
+            truncated: false,
+            originalChars: trimmed.length,
+            maxChars,
+        };
+    }
+    const omitted = trimmed.length - maxChars;
+    const ref = options.sourceRef?.trim();
+    const pointer = ref
+        ? [
+            `...[truncated for draft prompt: showing first ${maxChars} of ${trimmed.length} chars; omitted ${omitted} chars]`,
+            `Full source (authoritative, do not invent missing content): ${ref}`,
+            "When the omitted tail may affect acceptance/non-goals/constraints, re-read that file before deciding.",
+        ].join("\n")
+        : `...[truncated for draft prompt: showing first ${maxChars} of ${trimmed.length} chars; omitted ${omitted} chars]`;
+    return {
+        text: `${trimmed.slice(0, maxChars)}\n\n${pointer}`,
+        truncated: true,
+        originalChars: trimmed.length,
+        maxChars,
+    };
+}
+export function extractObjective(requirementMarkdown, title) {
+    const sectionMatchers = [
+        /##\s*(目标|Objective|Goals?)\s*\n([\s\S]*?)(?=\n##\s|\n#\s|$)/i,
+        /##\s*Description\s*\n([\s\S]*?)(?=\n##\s|\n#\s|$)/i,
+    ];
+    for (const matcher of sectionMatchers) {
+        const match = requirementMarkdown.match(matcher);
+        if (!match)
+            continue;
+        const body = (match[2] ?? match[1] ?? "").trim();
+        for (const line of body.split("\n")) {
+            const trimmed = line
+                .replace(/^[-*]\s*\[[ xX]\]\s*/, "")
+                .replace(/^[-*]\s*/, "")
+                .trim();
+            if (!trimmed || isHeadingLine(trimmed) || isMetadataLine(trimmed))
+                continue;
+            return trimmed.slice(0, 500);
+        }
+    }
+    const lines = requirementMarkdown.split("\n");
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || isHeadingLine(trimmed) || isMetadataLine(trimmed))
+            continue;
+        return trimmed.slice(0, 500);
+    }
+    return `Implement task: ${title}`;
+}
+export function extractSuccessCriteria(requirementMarkdown, taskId) {
+    const criteria = [];
+    const sectionMatch = requirementMarkdown.match(SUCCESS_CRITERIA_SECTION);
+    if (sectionMatch) {
+        for (const line of (sectionMatch[2] ?? "").split("\n")) {
+            const trimmed = line.replace(/^[-*]\s*\[[ xX]\]\s*/, "").trim();
+            if (trimmed.startsWith("-") || trimmed.startsWith("*")) {
+                criteria.push(trimmed.replace(/^[-*]\s*/, "").trim());
+            }
+            else if (trimmed.length > 0 && !trimmed.startsWith("#")) {
+                criteria.push(trimmed);
+            }
+        }
+    }
+    if (criteria.length > 0)
+        return criteria.slice(0, 8);
+    return [
+        `contract-pi produces an auditable read-only implementation contract for ${taskId}`,
+        "scout-src and scout-tests complete parallel read-only reconnaissance without file writes",
+        "plan-pi returns a read-only implementation plan aligned with constraints",
+        "the implementation writer changes only paths declared in writeSet",
+        "verify-pi returns read-only verification strategy and residual risks",
+        "closeout-pi returns read-only handoff summary without writing artifacts/docs",
+    ];
+}
+export function resolveImplementPaths(taskConfig, options = {}) {
+    if (taskConfig.allowedPaths.length > 0) {
+        const allowed = [...taskConfig.allowedPaths];
+        const forbidden = mergeForbiddenPaths(taskConfig);
+        const repoRoot = options.repoRoot;
+        let companions = [];
+        // Only consult the catalog when writer paths can touch docs/* so non-docs
+        // temp fixtures without a catalog keep working; docs writers still fail closed.
+        const mayNeedDocIndex = allowed.some((entry) => {
+            const normalized = entry.replace(/\\/g, "/").replace(/^\.\//, "");
+            return normalized === "docs" || normalized.startsWith("docs/");
+        });
+        if (repoRoot && mayNeedDocIndex) {
+            const closure = mergeDocumentIndexCompanions({
+                repoRoot,
+                paths: allowed,
+                forbiddenPaths: forbidden,
+            });
+            companions = closure.companions;
+            const explicitAllowedPaths = new Set(allowed.map((entry) => entry.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "")));
+            const missingCompanions = closure.companions.filter((companion) => !explicitAllowedPaths.has(companion));
+            if (missingCompanions.length > 0) {
+                throw new Error(`document-index-closure: catalog companion paths must be explicitly authorized in task allowedPaths: ${missingCompanions.map((companion) => `"${companion}"`).join(", ")}. Add each missing path with task advance --allowed-path <path>; required command(s): ${missingCompanions.map((companion) => `task advance --allowed-path ${companion}`).join("; ")}`);
+            }
+        }
+        return {
+            allowedPaths: allowed,
+            writeSet: [...allowed],
+            docIndexCompanions: companions,
+        };
+    }
+    return {
+        allowedPaths: ["**"],
+        writeSet: [IMPLEMENT_WRITESET_PLACEHOLDER],
+        docIndexCompanions: [],
+    };
+}
+export function applyMavenVerificationPlanning(input) {
+    if (!input.repoRoot || !input.commands || input.commands.length === 0) {
+        return { commands: input.commands };
+    }
+    const implement = resolveImplementPaths(input.taskConfig, {
+        repoRoot: input.repoRoot,
+    });
+    const planned = planMavenVerification({
+        repoRoot: input.repoRoot,
+        commands: input.commands,
+        scope: {
+            allowedPaths: input.taskConfig.allowedPaths ?? [],
+            writeSet: implement.writeSet,
+            sourcePaths: input.taskConfig.sourceFiles ?? [],
+        },
+    });
+    if (!planned.plan) {
+        return { commands: planned.commands };
+    }
+    // Freeze shell command digests against the serialized shell form used at runtime.
+    const shellCommands = buildVerifyShellCommands({
+        repoRoot: input.repoRoot,
+        commands: planned.commands,
+        fallbackCommands: [],
+    });
+    return {
+        commands: planned.commands,
+        mavenVerificationPlan: toDagMavenVerificationPlan(planned.plan, shellCommands),
+    };
+}
+export function extractFrontendVerifyCommandsFromMarkdown(input) {
+    if (!input.repoRoot)
+        return { staticCommands: [], behaviorCommands: [] };
+    const markdown = [
+        input.requirementMarkdown,
+        input.constraintMarkdown ?? "",
+    ].join("\n");
+    const commands = new Set();
+    for (const line of markdown.split(/\r?\n/)) {
+        const bulletless = line
+            .trim()
+            .replace(/^[-*]\s*(?:\[[ xX]\]\s*)?/, "")
+            .trim();
+        const codeSpanCommands = Array.from(bulletless.matchAll(/`([^`]+)`/g), (match) => match[1]?.trim() ?? "").filter(Boolean);
+        const candidates = codeSpanCommands.length > 0 ? codeSpanCommands : [bulletless];
+        for (const candidate of candidates) {
+            if (isSupportedMarkdownVerifyCommand(candidate)) {
+                commands.add(candidate);
+            }
+        }
+    }
+    const staticCommands = [];
+    const behaviorCommands = [];
+    for (const command of commands) {
+        const verifyCommand = markdownVerifyCommand(input.repoRoot, command);
+        if (!verifyCommand)
+            continue;
+        // Markdown is untrusted prose: admit only commands with known verification
+        // semantics before using the shared classifier. Explicit task verifyCommands
+        // are operator-authorized separately and do not pass through this filter.
+        if (!isRecognizedFrontendVerifyCommandText(command))
+            continue;
+        // Single shared classifier: never fork lane regexes here. The old
+        // inline static-first regex misclassified behavior commands whose
+        // arguments mention build paths (e.g. `npx vitest run
+        // test/build.test.ts`).
+        if (classifyFrontendVerifyCommandText(command) === "static") {
+            staticCommands.push(verifyCommand);
+        }
+        else {
+            behaviorCommands.push(verifyCommand);
+        }
+    }
+    return { staticCommands, behaviorCommands };
+}
+export function extractFrontendMockVerifyCommandsFromMarkdown(input) {
+    const commands = [];
+    const markdown = [
+        input.requirementMarkdown,
+        input.constraintMarkdown ?? "",
+    ].join("\n");
+    for (const line of markdown.split(/\r?\n/)) {
+        if (!/(?:mock|模拟服务|接口桩)/i.test(line))
+            continue;
+        for (const match of line.matchAll(/`([^`]+)`/g)) {
+            const commandText = match[1]?.trim();
+            if (!commandText || !isSupportedMarkdownVerifyCommand(commandText))
+                continue;
+            const command = markdownVerifyCommand(input.repoRoot, commandText);
+            if (command)
+                commands.push(command);
+        }
+    }
+    return commands.filter((command, index, all) => all.findIndex((candidate) => candidate.args.join("\0") === command.args.join("\0")) === index);
+}
+export function buildExplicitFrontendVerifyCommands(taskConfig, repoRoot) {
+    const staticCommands = [];
+    const behaviorCommands = [];
+    if (!repoRoot)
+        return { staticCommands, behaviorCommands };
+    for (const command of taskConfig.verifyCommands) {
+        const verifyCommand = {
+            args: ["bash", "-lc", command.command],
+            cwd: repoRoot,
+            label: command.label,
+            timeoutMs: command.timeoutMs,
+        };
+        // An explicit `mode` declaration wins over automatic classification. The
+        // operator knows the command's nature; the classifier only guesses from
+        // text. This matters because the behavior lane requires test-observation
+        // capability at writer admission, so a governance/lint script that text
+        // classification calls "behavior" blocks admission deterministically and
+        // no model-side fix can clear it. A declared command still runs and its
+        // exit code is still checked in whichever lane it lands.
+        // An undeclared command is classified by text, and
+        // `classifyFrontendVerifyCommand` fails at generation when that text
+        // carries no recognizable verification semantics. Failing there keeps the
+        // decision with the operator, where it is cheap to fix, instead of
+        // silently entering the test-observed behavior lane and surfacing much
+        // later as an unactionable `FRONTEND_TEST_OBSERVATION_INVALID`.
+        const mode = command.mode ??
+            classifyFrontendVerifyCommand(command.command, command.label);
+        if (mode === "static") {
+            staticCommands.push(verifyCommand);
+        }
+        else {
+            behaviorCommands.push(verifyCommand);
+        }
+    }
+    return { staticCommands, behaviorCommands };
+}
+export function tokenizeSimpleShellCommand(command) {
+    const tokens = [];
+    let token = "";
+    let quote = null;
+    let escaping = false;
+    let tokenStarted = false;
+    for (const char of command.trim()) {
+        if (escaping) {
+            token += char;
+            escaping = false;
+            tokenStarted = true;
+            continue;
+        }
+        if (char === "\\" && quote !== "'") {
+            escaping = true;
+            tokenStarted = true;
+            continue;
+        }
+        if (quote) {
+            if (quote === '"' && (char === "$" || char === "`"))
+                return undefined;
+            if (char === quote)
+                quote = null;
+            else
+                token += char;
+            tokenStarted = true;
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            quote = char;
+            tokenStarted = true;
+            continue;
+        }
+        if (/\s/.test(char)) {
+            if (tokenStarted)
+                tokens.push(token);
+            token = "";
+            tokenStarted = false;
+            continue;
+        }
+        if (/[;&|<>`\r\n]/.test(char) || char === "$" || char === "(") {
+            return undefined;
+        }
+        token += char;
+        tokenStarted = true;
+    }
+    if (escaping || quote)
+        return undefined;
+    if (tokenStarted)
+        tokens.push(token);
+    return tokens.length > 0 ? tokens : undefined;
+}
+export function canonicalizeVerificationCommands(commands) {
+    const byKey = new Map();
+    const merged = new Map();
+    for (const command of commands) {
+        const canonicalKey = verifyCommandKey(command);
+        const retained = byKey.get(canonicalKey);
+        if (!retained) {
+            byKey.set(canonicalKey, {
+                ...command,
+                env: command.env ? { ...command.env } : undefined,
+            });
+            merged.set(canonicalKey, {
+                canonicalKey,
+                keptLabel: command.label,
+                mergedLabels: [],
+                effectiveTimeoutMs: command.timeoutMs ?? null,
+            });
+            continue;
+        }
+        const retainedTimeout = retained.timeoutMs ?? 0;
+        const candidateTimeout = command.timeoutMs ?? 0;
+        if (candidateTimeout > retainedTimeout)
+            retained.timeoutMs = command.timeoutMs;
+        const mergedEntry = merged.get(canonicalKey);
+        mergedEntry.effectiveTimeoutMs = retained.timeoutMs ?? null;
+        mergedEntry.mergedLabels.push(command.label);
+    }
+    const retained = [...byKey.values()];
+    const aggregate = retained.find(isCheckRepoVerifyCommand);
+    const covered = [];
+    const commandsAfterCoverage = aggregate
+        ? retained.filter((command) => {
+            if (!isCheckRepoCoveredCommand(command))
+                return true;
+            covered.push({
+                aggregateLabel: aggregate.label,
+                coveredLabel: command.label,
+            });
+            return false;
+        })
+        : retained;
+    return {
+        commands: commandsAfterCoverage,
+        merged: [...merged.values()].filter((entry) => entry.mergedLabels.length > 0),
+        covered,
+    };
+}
+export function assertVerificationPlanPreflight(input) {
+    const root = path.resolve(input.repoRoot);
+    const statuses = [];
+    for (const command of input.commands) {
+        const cwd = path.resolve(command.cwd);
+        if (!isWithinRepo(root, cwd) || !existsSync(cwd)) {
+            throw new Error(`verification preflight rejected cwd for ${command.label}: ${command.cwd}`);
+        }
+        const vitestStatus = verifyVitestCommandPreflight({
+            command,
+            root,
+            taskConfig: input.taskConfig,
+        });
+        if (vitestStatus) {
+            statuses.push({ label: command.label, status: vitestStatus });
+            continue;
+        }
+        const script = localScriptTarget(command);
+        if (!script) {
+            statuses.push({ label: command.label, status: "ok" });
+            continue;
+        }
+        const scriptPath = path.resolve(cwd, script);
+        if (existsSync(scriptPath)) {
+            statuses.push({ label: command.label, status: "ok" });
+            continue;
+        }
+        const writerMayCreate = input.taskConfig.allowedPaths.some((allowed) => pathMatchesPattern(script, allowed.replace(/^\.\//, "")));
+        if (!writerMayCreate) {
+            throw new Error(`verification preflight missing local script for ${command.label}: ${script}`);
+        }
+        statuses.push({ label: command.label, status: "future-delivery-script" });
+    }
+    return statuses;
+}
+export function verifyVitestCommandPreflight(input) {
+    const args = normalizeVerifyCommandArgs(input.command.args);
+    const vitestIndex = args.findIndex((arg) => path.basename(arg).replace(/\.(?:exe|cmd)$/i, "") === "vitest");
+    if (vitestIndex < 0)
+        return undefined;
+    const configArgIndex = args.findIndex((arg, index) => index > vitestIndex &&
+        (arg === "--config" || arg === "-c" || arg.startsWith("--config=")));
+    let configPath;
+    if (configArgIndex >= 0) {
+        const arg = args[configArgIndex];
+        configPath = arg.startsWith("--config=")
+            ? arg.slice("--config=".length)
+            : args[configArgIndex + 1];
+    }
+    const cwd = path.resolve(input.command.cwd);
+    const configAbsolute = configPath
+        ? path.resolve(cwd, configPath)
+        : findRootVitestConfig(input.root);
+    const configRelative = configAbsolute
+        ? path.relative(input.root, configAbsolute).replace(/\\/g, "/")
+        : undefined;
+    if (configAbsolute && !existsSync(configAbsolute)) {
+        const writerMayCreate = Boolean(configRelative &&
+            input.taskConfig.allowedPaths.some((allowed) => pathMatchesPattern(configRelative, allowed.replace(/^\.\//, ""))));
+        if (!writerMayCreate) {
+            throw new Error(`verification preflight missing Vitest config for ${input.command.label}: ${configRelative ?? configPath}`);
+        }
+    }
+    const targetPaths = vitestTargetPaths(args.slice(vitestIndex + 1));
+    if (targetPaths.length === 0)
+        return "ok";
+    const inheritedConfig = !configPath && configAbsolute && existsSync(configAbsolute);
+    if (inheritedConfig && vitestConfigExcludesDogfood(configAbsolute, targetPaths)) {
+        throw new Error(`verification preflight Vitest target ${targetPaths.join(", ")} is excluded by ${path.relative(input.root, configAbsolute).replace(/\\/g, "/")}`);
+    }
+    const futureTargets = targetPaths.filter((target) => {
+        const absolute = path.resolve(cwd, target);
+        if (existsSync(absolute))
+            return false;
+        return !input.taskConfig.allowedPaths.some((allowed) => pathMatchesPattern(target, allowed.replace(/^\.\//, "")));
+    });
+    if (futureTargets.length > 0) {
+        throw new Error(`verification preflight missing Vitest target for ${input.command.label}: ${futureTargets.join(", ")}`);
+    }
+    const missingAllowedTargets = targetPaths.filter((target) => !existsSync(path.resolve(cwd, target)));
+    return missingAllowedTargets.length > 0 ? "future-test-target" : "ok";
+}
+export function isFullSuiteVerifyCommand(command) {
+    const args = normalizeVerifyCommandArgs(command.args);
+    let index = 0;
+    while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(args[index] ?? ""))
+        index += 1;
+    const executable = path
+        .basename(args[index] ?? "")
+        .toLowerCase()
+        .replace(/\.(?:exe|cmd)$/, "");
+    const rest = args.slice(index + 1);
+    if (["npm", "pnpm", "yarn", "bun"].includes(executable)) {
+        return ((rest.length === 1 && rest[0] === "test") ||
+            (rest.length === 2 && rest[0] === "run" && rest[1] === "test"));
+    }
+    if (["bash", "sh"].includes(executable) && rest.length === 1) {
+        return /(?:^|\/)scripts\/(?:ci|check-repo)\.sh$/i.test((rest[0] ?? "").replace(/\\/g, "/"));
+    }
+    return (rest.length === 0 &&
+        /(?:^|\/)scripts\/(?:ci|check-repo)\.sh$/i.test((args[index] ?? "").replace(/\\/g, "/")));
+}
+export function buildVerifyEvidence(input) {
+    const selectedCommands = input.commands && input.commands.length > 0 ? input.commands : undefined;
+    const commandCount = selectedCommands?.length ?? input.fallbackCommands.length;
+    return {
+        phase: input.phase,
+        quota: input.quota,
+        commandSource: input.commandSource,
+        commandCount,
+        commandLabels: selectedCommands?.map((command) => command.label) ??
+            input.fallbackCommands,
+        commandTexts: input.commandTexts ?? [],
+        canonicalKeys: selectedCommands?.map(verifyCommandKey) ?? [],
+        mergedCommands: input.plan?.merged ?? [],
+        coveredCommands: input.plan?.covered ?? [],
+        selectionReasons: selectedCommands?.map((command) => input.phase === "intermediate" && isFullSuiteVerifyCommand(command)
+            ? `${command.label}: deferred-heavy`
+            : `${command.label}: kept`) ?? [],
+        preflight: input.preflight ??
+            (selectedCommands?.map((command) => ({
+                label: command.label,
+                status: "ok",
+            })) ?? []),
+        commandTimeoutMs: input.commandTimeoutMs,
+        totalTimeoutBudgetMs: commandCount * input.commandTimeoutMs,
+        finalFullRequired: input.finalFullRequired,
+    };
+}
+export function partitionFrontendStaticVerifyCommands(input) {
+    const commands = input.commands ?? [];
+    // Frontend DAGs deliberately never generate lint verification. Existing
+    // project lint debt is allowed to remain outside this workflow, and an
+    // explicitly mentioned lint command must not reintroduce the lint gate.
+    const staticCommands = commands.filter((command) => !isFrontendLintVerifyCommand(command));
+    return {
+        lint: {
+            commandSource: input.commandSource,
+        },
+        static: {
+            ...(staticCommands.length > 0 ? { commands: staticCommands } : {}),
+            commandSource: input.commandSource,
+        },
+    };
+}
+export async function discoverFrontendFallbackVerifyCommands(repoRoot) {
+    const genericFallback = {
+        staticCommands: ["npm run typecheck", "npm run build"],
+        behaviorCommands: ["npm test"],
+    };
+    if (!repoRoot)
+        return genericFallback;
+    let scripts;
+    try {
+        const packageJson = JSON.parse(await readFile(path.join(repoRoot, "package.json"), "utf8"));
+        if (packageJson.scripts && typeof packageJson.scripts === "object") {
+            scripts = packageJson.scripts;
+        }
+    }
+    catch {
+        // No readable manifest: leave scripts unset and keep probing.
+    }
+    let packageManager = "npm";
+    for (const [lockfile, manager] of [
+        ["pnpm-lock.yaml", "pnpm"],
+        ["yarn.lock", "yarn"],
+        ["bun.lockb", "bun"],
+        ["bun.lock", "bun"],
+    ]) {
+        try {
+            await access(path.join(repoRoot, lockfile));
+            packageManager = manager;
+            break;
+        }
+        catch {
+            // Try the next package-manager marker.
+        }
+    }
+    const commandForScript = (script) => script === "test"
+        ? `${packageManager} test`
+        : `${packageManager} run ${script}`;
+    const hasScript = (script) => typeof scripts?.[script] === "string" &&
+        String(scripts[script]).trim().length > 0;
+    const firstExisting = (names) => {
+        const selected = [];
+        for (const name of names) {
+            if (hasScript(name) && !selected.includes(name))
+                selected.push(name);
+        }
+        return selected.map(commandForScript);
+    };
+    const staticCommands = firstExisting([
+        "typecheck",
+        "check-types",
+        "check",
+        "build",
+    ]);
+    const behaviorCommands = firstExisting([
+        "test:unit",
+        "test:frontend",
+        "test:component",
+        "test",
+        "test:e2e",
+        "e2e",
+    ]);
+    if (staticCommands.length === 0 && behaviorCommands.length === 0) {
+        try {
+            await access(path.join(repoRoot, "node_modules", ".bin", "tsc"));
+            staticCommands.push("npx --no-install tsc --noEmit");
+        }
+        catch {
+            // No local TypeScript binary: leave verification unavailable rather
+            // than invoking a missing script or downloading a package.
+        }
+    }
+    return {
+        staticCommands: staticCommands.length > 0 ? staticCommands : [],
+        behaviorCommands: behaviorCommands.length > 0 ? behaviorCommands : [],
+    };
+}
+export function extractExplicitRequirementIds(requirementMarkdown, ...fallbackMarkdown) {
+    const ids = [];
+    const seen = new Set();
+    const collect = (markdown, declarationsOnly) => {
+        if (!markdown)
+            return;
+        const source = declarationsOnly
+            ? markdown
+                .split(/\r?\n/)
+                .filter((line) => isRequirementIdDeclarationLine(line))
+                .join("\n")
+            : markdown;
+        for (const match of source.matchAll(/\b(?:REQ|BR|AC)-[A-Z0-9]+(?:-[A-Z0-9]+)*\b/gi)) {
+            const id = match[0].toUpperCase();
+            if (isPlaceholderRequirementId(id))
+                continue;
+            if (!seen.has(id)) {
+                seen.add(id);
+                ids.push(id);
+            }
+        }
+    };
+    // The requirement document itself is human-authored acceptance prose:
+    // only declaration lines declare requirements there. If the document has
+    // no declaration-shaped lines at all (minimal free-form tasks like
+    // "covers AC-001"), fall back to its full text so bindings never go
+    // missing for unstructured input. References and constraints are bound
+    // documents (acceptance yaml, analysis docs) whose ids are authoritative
+    // wherever they appear — keep full scan for them.
+    const declarationLines = requirementMarkdown
+        .split(/\r?\n/)
+        .filter((line) => isRequirementIdDeclarationLine(line));
+    collect(requirementMarkdown, declarationLines.length > 0);
+    for (const markdown of fallbackMarkdown) {
+        if (markdown)
+            collect(markdown, false);
+    }
+    return ids;
+}
+export function extractTaskScopedRequirementIds(requirementMarkdown, ...fallbackMarkdown) {
+    // Only the explicit TaskSpec-derived section is authoritative for scope.
+    // Without it, preserve legacy full-scan behavior (requirement + references).
+    const sectionMatch = requirementMarkdown.match(/(?:^|\n)##\s*Acceptance References\s*\n([\s\S]*?)(?=\n##\s+|\n#\s+|$)/i);
+    if (sectionMatch?.[1]) {
+        const fromSection = extractSectionRequirementIds(sectionMatch[1]);
+        if (fromSection.length > 0)
+            return fromSection;
+    }
+    const explicit = extractExplicitRequirementIds(requirementMarkdown, ...fallbackMarkdown);
+    if (explicit.length > 0)
+        return explicit;
+    // Requirements frequently use a numbered acceptance list instead of
+    // writing AC-* identifiers. Give that list a deterministic canonical
+    // namespace so model-generated AC-1 references bind to the same source
+    // facts instead of failing as unknown requirements at the prewrite gate.
+    const acceptanceSection = requirementMarkdown.match(/(?:^|\n)##\s*(?:验收标准|Acceptance Criteria)\s*\n([\s\S]*?)(?=\n##\s+|\n#\s+|$)/i)?.[1] ?? "";
+    const numbered = [...acceptanceSection.matchAll(/(?:^|\n)\s*(\d+)[.、)]\s+/g)]
+        .map((match) => Number(match[1]))
+        .filter((value, index, values) => Number.isFinite(value) && values.indexOf(value) === index)
+        .sort((a, b) => a - b);
+    return numbered.map((value) => `AC-${value}`);
+}
+export function probePathsForWriteSetEntry(entry) {
+    const normalized = entry.replace(/\\/g, "/").replace(/^\.\//, "");
+    if (!normalized.includes("*")) {
+        return [normalized];
+    }
+    const concrete = normalized
+        .replace(/\/\*\*$/, "/_probe_")
+        .replace(/\*\*$/, "_probe_")
+        .replace(/\*/g, "_");
+    return Array.from(new Set([normalized, concrete]));
+}
+export function buildDagSourceBindingBase(sources) {
+    const sourceEntries = [
+        {
+            kind: "requirement",
+            path: sources.requirementPath,
+            markdown: sources.requirementMarkdown,
+        },
+        ...(sources.constraintMarkdown
+            ? [
+                {
+                    kind: "constraint",
+                    path: sources.constraintPath,
+                    markdown: sources.constraintMarkdown,
+                },
+            ]
+            : []),
+        ...(sources.referenceDocuments ?? []).map((reference) => ({
+            kind: "reference",
+            path: reference.path,
+            markdown: reference.markdown,
+        })),
+    ];
+    return {
+        schemaVersion: 1,
+        taskId: sources.taskId,
+        sources: sourceEntries.map((source) => ({
+            kind: source.kind,
+            path: toDagSourcePath(sources, source.path),
+            sha256: createHash("sha256")
+                .update(source.markdown, "utf8")
+                .digest("hex"),
+        })),
+        requirementIds: extractTaskScopedRequirementIds(sources.requirementMarkdown, sources.constraintMarkdown, ...(sources.referenceDocuments ?? []).map((reference) => reference.markdown)),
+    };
+}
+export function loadPersistedFrontendSourceBindingLedger(sources) {
+    const referenceDocs = (sources.referenceDocuments ?? []).filter((doc) => doc.markdown.trim().length > 0);
+    const ledgerAbsolutePath = path.join(sources.taskDir, "source", REQUIREMENT_LEDGER_FILE_NAME);
+    // Text-created frontend tasks have no imported reference manifest. Their
+    // task-owned projected requirement is nevertheless a valid canonical source
+    // document and is persisted in the v2 ledger by source preparation. Keep it
+    // in the current-input map below instead of silently downgrading to v1.
+    // 存在性守卫（保持既有 v1 回退行为）：派生视图无可抽取 requirement/acceptance
+    // 引用时不要求持久化 ledger，直接回退 base binding。此守卫只用于"是否 ledger
+    // 任务"判定，绝不参与 digest 键计算——键输入完全来自持久化 ledger 恢复。
+    const guardFacts = extractRequirementFactsFromMarkdown(sources.requirementMarkdown);
+    if (guardFacts.acceptanceCriteria.length === 0 && referenceDocs.length > 0)
+        return null;
+    if (referenceDocs.length === 0 && !existsSync(ledgerAbsolutePath))
+        return null;
+    let raw;
+    try {
+        raw = readFileSync(ledgerAbsolutePath, "utf8");
+    }
+    catch (error) {
+        throw new Error(`SOURCE_FIDELITY_LEDGER_MISSING: frontend task ${sources.taskId} has resolvable requirement/acceptance references but no persisted ${REQUIREMENT_LEDGER_FILE_NAME} at ${ledgerAbsolutePath}; run task advance (intake) to persist the ledger before dag init-hybrid (${error instanceof Error ? error.message : String(error)})`);
+    }
+    const ledgerSha256 = createHash("sha256").update(raw).digest("hex");
+    let ledger;
+    try {
+        ledger = parseLedgerJson(raw);
+    }
+    catch (error) {
+        throw new Error(`SOURCE_FIDELITY_LEDGER_MISSING: persisted ${REQUIREMENT_LEDGER_FILE_NAME} is not a valid v1 ledger: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const ledgerErrors = validateRequirementLedger(ledger);
+    if (ledgerErrors.length > 0) {
+        const first = ledgerErrors[0];
+        throw new Error(`${first.code}: persisted ${REQUIREMENT_LEDGER_FILE_NAME} is invalid; refusing to start a frontend DAG with incomplete source bindings (${ledgerErrors
+            .map((error) => error.message)
+            .join("; ")})`);
+    }
+    // canonical 侧：ledger.canonicalRequirements 按 build 顺序原样保留输入 canonical
+    // requirements（id/text 逐字节），过滤物化 REQ-SRC-*（AC-HARD-002 "物化不入键"）
+    // 即精确恢复 digest 输入集；派生导航视图 需求.md 投影不参与键计算。
+    const contract = recoverLedgerInputContract(ledger);
+    if (contract.canonicalRequirements.length === 0) {
+        // AC-HARD-003：存在 v2 ledger 但 canonical requirements 为空时 fail closed，
+        // 绝不回退 v1 base 绑定（buildDagSourceBinding 不降级）。空 canonical 的 ledger
+        // 无法提供 requirement→fragment 映射证据，任何 v1 回退都会静默放行 fail-open。
+        throw new Error(`SOURCE_FIDELITY_LEDGER_STALE: persisted ${REQUIREMENT_LEDGER_FILE_NAME} has an empty canonical requirement set; refusing to fall back to a v1 base binding; re-run task advance (intake) to rebuild the ledger`);
+    }
+    // source 侧：ledger.sourcePaths（build 时权威 sourceDocuments 的 repo-root
+    // relative POSIX 路径集合）作为权威身份集合，对当前 materialized reference 文件
+    // 做交集过滤；内容取当前字节（漂移检测）。权威路径缺失（删除/清空/重命名）→
+    // fail-closed STALE；新增的非权威 role 文件被正确排除（不入键）。
+    const currentByPath = new Map();
+    for (const doc of referenceDocs) {
+        currentByPath.set(toDagSourcePath(sources, doc.path), doc.markdown);
+    }
+    if (referenceDocs.length === 0) {
+        currentByPath.set(toDagSourcePath(sources, sources.requirementPath), 
+        // applyTaskContract appends a derived `## Source ledger` navigation
+        // block after the ledger input has been hashed. Remove that block when
+        // reconstructing the canonical text digest.
+        sources.requirementMarkdown.replace(/\n## Source ledger\b[\s\S]*$/u, ""));
+    }
+    const missingAuthoritativePaths = contract.sourcePaths.filter((sourcePath) => !currentByPath.has(sourcePath));
+    if (missingAuthoritativePaths.length > 0) {
+        throw new Error(`SOURCE_FIDELITY_LEDGER_STALE: persisted ${REQUIREMENT_LEDGER_FILE_NAME} was built from authoritative source documents no longer present (${missingAuthoritativePaths.join(", ")}); re-run task advance (intake) to rebuild the ledger`);
+    }
+    // inputDigest 新鲜度：与当前源输入（canonical repo-root relative identity）一致。
+    // digest 只绑定语义权威输入（规范化源文档 + canonical requirements +
+    // schema/reconciler version）；派生导航视图 需求.md 投影不参与键计算。
+    const expectedDigest = computeLedgerInputDigest({
+        sourceDocuments: contract.sourcePaths.map((sourcePath) => ({
+            path: sourcePath,
+            content: currentByPath.get(sourcePath),
+        })),
+        canonicalRequirements: contract.canonicalRequirements,
+    });
+    if (ledger.inputDigest !== expectedDigest) {
+        throw new Error(`SOURCE_FIDELITY_LEDGER_STALE: persisted ${REQUIREMENT_LEDGER_FILE_NAME} inputDigest ${ledger.inputDigest} does not match current source input ${expectedDigest}; re-run task advance (intake) to rebuild the ledger`);
+    }
+    const requirementToFragments = {};
+    for (const requirement of ledger.canonicalRequirements) {
+        if (requirement.sourceFragmentIds.length > 0) {
+            requirementToFragments[requirement.id] = requirement.sourceFragmentIds;
+        }
+    }
+    return {
+        ledgerPath: toDagSourcePath(sources, ledgerAbsolutePath),
+        ledgerSha256,
+        inputDigest: ledger.inputDigest,
+        requirementIds: ledger.canonicalRequirements.map((requirement) => requirement.id),
+        requirementToFragments,
+    };
+}
+export function buildBackendTestAnalysisSourceBindingContract(sources) {
+    const binding = buildDagSourceBinding(sources);
+    const requirement = binding.sources.find((source) => source.kind === "requirement");
+    if (!requirement) {
+        throw new Error("backend-test analysis requires a requirement source binding");
+    }
+    return {
+        taskId: binding.taskId,
+        requirementPath: requirement.path,
+        requirementSha256: requirement.sha256,
+        referencePaths: binding.sources
+            .filter((source) => source.kind === "reference")
+            .map((source) => source.path),
+        requirementIds: binding.requirementIds,
+    };
+}
+export function buildSourceContextBlock(sources, options = {}) {
+    const includeRequirementExcerpt = options.includeRequirementExcerpt ?? true;
+    const includeConstraintExcerpt = options.includeConstraintExcerpt ?? true;
+    const includeReferenceDocuments = options.includeReferenceDocuments ?? true;
+    const requirementRef = toDagSourcePath(sources, sources.requirementPath);
+    const requirementExcerpt = excerptMarkdown(sources.requirementMarkdown, {
+        sourceRef: requirementRef,
+    });
+    const boundReadPaths = [`- requirement: ${requirementRef}`];
+    const parts = [
+        `## Task source: 需求.md`,
+        `Bound readPath (use for Pi read-tool calls): ${requirementRef}`,
+        ...(includeRequirementExcerpt ? [requirementExcerpt.text] : []),
+    ];
+    if (sources.constraintMarkdown) {
+        const constraintRef = toDagSourcePath(sources, sources.constraintPath);
+        const constraintExcerpt = excerptMarkdown(sources.constraintMarkdown, {
+            sourceRef: constraintRef,
+        });
+        boundReadPaths.push(`- constraints: ${constraintRef}`);
+        parts.push("## Task source: 执行约束.md", `Bound readPath (use for Pi read-tool calls): ${constraintRef}`, ...(includeConstraintExcerpt ? [constraintExcerpt.text] : []));
+    }
+    for (const reference of (includeReferenceDocuments
+        ? sources.referenceDocuments ?? []
+        : []).slice(0, MAX_INLINE_SOURCE_REFERENCE_DOCUMENTS)) {
+        const relativePath = path
+            .relative(path.join(sources.taskDir, "source"), reference.path)
+            .replaceAll(path.sep, "/");
+        const referenceRef = toDagSourcePath(sources, reference.path);
+        const referenceExcerpt = excerptMarkdown(reference.markdown, {
+            sourceRef: referenceRef,
+        });
+        boundReadPaths.push(`- reference ${relativePath}: ${referenceRef}`);
+        parts.push(`## Task source reference: ${relativePath}`, `Bound readPath (use for Pi read-tool calls): ${referenceRef}`, referenceExcerpt.text);
+    }
+    parts.push("## Bound source read paths", ...boundReadPaths, "Use these repository-readable paths for any Pi read-tool calls. Bound files under `.harness/tasks/<taskId>/source/**` are read-only inputs: reading them is allowed even though writing `.harness/**` is forbidden.", "Never resolve task-relative citations such as `source/需求.md` or `source/references/*` against the repository root, invent `source/<taskId>/...`, search for substitutes, or fall back to `docs/**` when a bound read fails.", "## Task config summary", `- taskId: ${sources.taskConfig.taskId}`, `- flow: ${sources.taskConfig.flow}`, `- complexity: ${sources.taskConfig.complexity}`, `- contextProfile: ${sources.taskConfig.contextProfile}`, `- allowedPaths: ${sources.taskConfig.allowedPaths.join(", ") || "(none — review before execute)"}`, `- forbiddenPaths: ${sources.taskConfig.forbiddenPaths.join(", ") || "(none)"}`, '- Pi DAG nodes are read-only unless toolProfile="write" is explicitly selected for a bounded writer node.', "- Agent DAG read-only nodes must not write root artifacts/**; root artifacts/ is not a per-node scratchpad.", `- Derived execution contract and immutable references live under the Bound source read paths above (not as repo-root \`source/...\`).`);
+    if (sources.taskConfig.hardConstraints.length > 0) {
+        parts.push("- hardConstraints:", ...sources.taskConfig.hardConstraints.map((c) => `  - ${c}`));
+    }
+    return parts.join("\n\n");
+}
+export async function loadMaterializedSourceReferences(sourceDir) {
+    const referenceDir = path.join(sourceDir, REFERENCE_DIRECTORY);
+    const referencePaths = [];
+    async function collect(dir) {
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw error;
+        }
+        for (const entry of entries) {
+            const entryPath = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                await collect(entryPath);
+            }
+            else if (entry.isFile()) {
+                // Skip index/manifest sidecars; keep only user/source reference content.
+                if (entry.name === "index.json" ||
+                    entry.name === "source-manifest.json") {
+                    continue;
+                }
+                referencePaths.push(entryPath);
+            }
+        }
+    }
+    await collect(referenceDir);
+    referencePaths.sort((left, right) => left.localeCompare(right));
+    return Promise.all(referencePaths.map(async (filePath) => ({
+        path: filePath,
+        markdown: await readFile(filePath, "utf-8"),
+    })));
+}
+export async function loadTaskHybridSources(repoRoot, taskId) {
+    const paths = getTaskPaths(repoRoot, taskId);
+    const requirementPath = path.join(paths.sourceDir, REQUIREMENT_FILE);
+    const constraintPath = path.join(paths.sourceDir, CONSTRAINT_FILE);
+    try {
+        await access(paths.taskConfigPath);
+    }
+    catch {
+        throw new Error(`task.json not found for task "${taskId}": expected ${paths.taskConfigPath}`);
+    }
+    const taskConfig = await loadTaskConfig(repoRoot, taskId);
+    // Baseline boundaries are independently knowable from task.json and must
+    // not be masked by source or adapter verification loading failures.
+    assertTaskAllowedPathsPreflight(taskConfig);
+    let requirementMarkdown;
+    try {
+        requirementMarkdown = await readFile(requirementPath, "utf-8");
+    }
+    catch {
+        throw new Error(`required source file missing for task "${taskId}": ${requirementPath}`);
+    }
+    let constraintMarkdown = null;
+    try {
+        constraintMarkdown = await readFile(constraintPath, "utf-8");
+    }
+    catch {
+        // optional
+    }
+    await materializeTaskReferenceDocs({
+        repoRoot,
+        taskId,
+        taskConfig,
+    });
+    const referenceDocuments = await loadMaterializedSourceReferences(paths.sourceDir);
+    const manifest = await loadHarnessManifest(repoRoot);
+    const strategy = resolveDagVerifyStrategy(taskConfig);
+    let verifyCommands;
+    let verificationPreflight = [];
+    try {
+        const adapter = await resolveAdapter(repoRoot);
+        const preset = resolveVerifyPreset(taskConfig.verifyPreset, taskConfig);
+        const adapterIntermediate = adapter.getVerifyCommands(repoRoot, {
+            preset,
+            quota: strategy.intermediateQuota,
+            phase: "intermediate",
+            taskConfig,
+        });
+        const adapterFinal = adapter.getVerifyCommands(repoRoot, {
+            preset,
+            quota: "full",
+            phase: "final",
+            taskConfig,
+        });
+        const intermediatePlan = canonicalizeVerificationCommands([
+            ...taskVerifyCommands(repoRoot, taskConfig),
+            ...adapterIntermediate,
+        ]);
+        const finalPlan = canonicalizeVerificationCommands([
+            ...taskVerifyCommands(repoRoot, taskConfig),
+            ...adapterFinal,
+        ]);
+        verificationPreflight = assertVerificationPlanPreflight({
+            repoRoot,
+            commands: [...intermediatePlan.commands, ...finalPlan.commands],
+            taskConfig,
+        });
+        verifyCommands = {
+            intermediate: [
+                ...taskVerifyCommands(repoRoot, taskConfig),
+                ...adapterIntermediate,
+            ],
+            final: [...taskVerifyCommands(repoRoot, taskConfig), ...adapterFinal],
+        };
+        if (verifyCommands.final.length === 0) {
+            throw new Error("adapter returned no final verification commands");
+        }
+    }
+    catch (error) {
+        throw new Error(`failed to load verification commands for task "${taskId}": ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const frontendShapeTransitionCapsule = taskConfig.taskKind === "frontend-implementation" && CANONICAL_TASK_ID_PATTERN.test(taskId)
+        ? await discoverLatestCommittedFrontendShapeCapsule({
+            repoRoot,
+            taskId,
+            sourceDigest: computeFrontendShapeSourceDigest({
+                requirementMarkdown,
+                constraintMarkdown: constraintMarkdown ?? "",
+            }),
+        })
+        : undefined;
+    const sources = {
+        taskId,
+        repoRoot,
+        taskDir: paths.taskDir,
+        requirementPath,
+        constraintPath,
+        requirementMarkdown,
+        constraintMarkdown,
+        outputLanguage: manifest.workflowPolicy.dag.outputLanguage,
+        referenceDocuments,
+        taskConfig,
+        enabledExecutors: resolveEnabledExecutors(manifest.executors),
+        executorModelMatrix: resolveExecutorModelMatrices(manifest),
+        verifyCommands,
+        verificationPreflight,
+        sddEmbeddedSkills: await probeRepoLocalSddSkills(repoRoot),
+        projectGovernancePresent: await discoverProjectGovernancePresence(repoRoot),
+        ...(frontendShapeTransitionCapsule ? { autoloadedFrontendShapeTransitionCapsule: frontendShapeTransitionCapsule } : {}),
+    };
+    return sources;
+}
+export async function prepareFrontendMockSources(sources, discoveredProjectCapability) {
+    const repoRoot = sources.repoRoot ?? process.cwd();
+    const capability = await discoverFrontendMockCapability(repoRoot, sources.taskConfig);
+    const sourceMockVerifyCommands = extractFrontendMockVerifyCommandsFromMarkdown({
+        repoRoot,
+        requirementMarkdown: sources.requirementMarkdown,
+        constraintMarkdown: sources.constraintMarkdown,
+    });
+    for (const command of sourceMockVerifyCommands) {
+        if (!capability.verifyCommands.some((existing) => existing.args.join("\0") === command.args.join("\0"))) {
+            capability.verifyCommands.push(command);
+        }
+    }
+    const projectCapability = discoveredProjectCapability ??
+        (await discoverFrontendProjectCapability(repoRoot, {
+            specRoots: sources.taskConfig.frontendOpenspec?.specRoots,
+        }));
+    const frontendRisk = classifyFrontendRisk({
+        title: sources.taskConfig.title,
+        requirementMarkdown: sources.requirementMarkdown,
+        constraintMarkdown: sources.constraintMarkdown ?? undefined,
+        allowedPaths: sources.taskConfig.allowedPaths,
+        forbiddenPaths: sources.taskConfig.forbiddenPaths,
+        complexity: sources.taskConfig.complexity,
+        manifestEvidence: [
+            projectCapability.framework,
+            projectCapability.frameworkVersion ?? "",
+            projectCapability.adapterGuidance,
+        ].join("\n"),
+    });
+    return {
+        ...sources,
+        frontendMockCapability: capability,
+        frontendMockMode: resolveFrontendMockMode(capability, sources.taskConfig, hasApiDependency(sources)),
+        frontendProjectCapability: projectCapability,
+        frontendRisk,
+    };
+}
+export function mergeForbiddenPaths(taskConfig) {
+    const merged = new Set([
+        ".harness/**",
+        ".harness/dag-runs/**",
+        "artifacts/**",
+        ...taskConfig.forbiddenPaths,
+    ]);
+    return [...merged];
+}
+export function patternStaticPrefix(pattern) {
+    const normalized = pattern.replace(/\\/g, "/").replace(/^\.\//, "");
+    const wildcard = normalized.search(/[?*]/);
+    return (wildcard >= 0 ? normalized.slice(0, wildcard) : normalized).replace(/\/+$/, "");
+}
+export function allowedPathHitsBaselineForbidden(allowedPath) {
+    const probes = probePathsForWriteSetEntry(allowedPath);
+    for (const forbidden of BASELINE_FORBIDDEN_PATHS) {
+        if (probes.some((probe) => pathMatchesPattern(probe, forbidden)) ||
+            pathMatchesPattern(allowedPath, forbidden) ||
+            pathMatchesPattern(forbidden, allowedPath)) {
+            return forbidden;
+        }
+    }
+    return undefined;
+}
+export function assertTaskAllowedPathsPreflight(taskConfig) {
+    for (const allowedPath of taskConfig.allowedPaths) {
+        const forbidden = allowedPathHitsBaselineForbidden(allowedPath);
+        if (forbidden) {
+            throw new Error(`task allowedPaths entry "${allowedPath}" overlaps baseline forbidden path "${forbidden}"; task source paths are main-session owned and must not be executor writeSet`);
+        }
+    }
+}
+export function buildDagSourceBinding(sources, taskKind) {
+    const base = buildDagSourceBindingBase(sources);
+    if (taskKind !== "frontend-implementation")
+        return base;
+    const ledgerBinding = loadPersistedFrontendSourceBindingLedger(sources);
+    if (!ledgerBinding)
+        return base;
+    // v2 is ledger-owned: the persisted canonical set is the only requirement
+    // identity source. In particular, explanatory AC-XXX mentions from a
+    // materialized reference document must not leak in beside ledger ids.
+    return {
+        schemaVersion: 2,
+        taskId: base.taskId,
+        sources: base.sources,
+        requirementIds: ledgerBinding.requirementIds,
+        ledgerPath: ledgerBinding.ledgerPath,
+        ledgerSha256: ledgerBinding.ledgerSha256,
+        inputDigest: ledgerBinding.inputDigest,
+        requirementToFragments: ledgerBinding.requirementToFragments,
+    };
+}
+export function buildVerifyShellCommands(input) {
+    if (!input.repoRoot || !input.commands || input.commands.length === 0) {
+        return input.fallbackCommands;
+    }
+    const repoRoot = input.repoRoot;
+    return input.commands.map((command) => verifyCommandToShell(repoRoot, command));
+}
+export function classifyFrontendVerifyCommand(command, label) {
+    const mode = classifyFrontendVerifyCommandText(command);
+    if (!mode) {
+        throw new Error(`verifyCommands[${label}]: unrecognized verification command ${JSON.stringify(command)}; declare its lane explicitly with mode: "static" or mode: "behavior", or use a recognized test runner such as \`npx vitest run\``);
+    }
+    return mode;
+}
+export const CONSTRAINT_FILE = "执行约束.md";
+export function extractSectionRequirementIds(sectionMarkdown) {
+    const ids = [];
+    const seen = new Set();
+    for (const match of sectionMarkdown.matchAll(/\b(?:REQ|BR|AC)-[A-Z0-9]+(?:-[A-Z0-9]+)*\b/gi)) {
+        const id = match[0].toUpperCase();
+        if (isPlaceholderRequirementId(id))
+            continue;
+        if (!seen.has(id)) {
+            seen.add(id);
+            ids.push(id);
+        }
+    }
+    return ids;
+}
+export function findRootVitestConfig(root) {
+    for (const name of ["vitest.config.ts", "vitest.config.js", "vitest.config.mjs", "vitest.config.cjs"]) {
+        const candidate = path.join(root, name);
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return undefined;
+}
+export { INTERACTIVE_UI_DELIVERY_CONTRACT } from "./types.js";
+export function isCheckRepoCoveredCommand(command) {
+    const target = localScriptTarget(command);
+    return target ? CHECK_REPO_COVERED_SCRIPTS.has(target) : false;
+}
+export function isCheckRepoVerifyCommand(command) {
+    return normalizeVerifyCommandArgs(command.args)
+        .join(" ")
+        .replaceAll("\\", "/")
+        .includes("scripts/check-repo.sh");
+}
+export function isFrontendLintVerifyCommand(command) {
+    const text = `${command.label}\n${command.args.join(" ")}`;
+    return /\b(?:lint|eslint)\b/i.test(text);
+}
+export function isHeadingLine(line) {
+    return /^#{1,6}\s+/.test(line.trim());
+}
+export function isMetadataLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed)
+        return true;
+    if (/^(TaskSpec business id|Feature id|Task type|Risk level)\s*:/i.test(trimmed)) {
+        return true;
+    }
+    if (/^(权威来源|SHA-256|冲突时以)/.test(trimmed))
+        return true;
+    if (/^>/.test(trimmed) &&
+        /(权威来源|SHA-256|原始 PRD|reference)/i.test(trimmed)) {
+        return true;
+    }
+    return false;
+}
+export function isPlaceholderRequirementId(id) {
+    return /(?:^|-)X{2,}$/.test(id);
+}
+export function isRequirementIdDeclarationLine(line) {
+    return REQUIREMENT_ID_DECLARATION_LINE.test(line);
+}
+export function isSupportedMarkdownVerifyCommand(command) {
+    return (/^(npm|pnpm|yarn|bun)\s+(run\s+)?[a-z0-9:_-]+(?:\s.*)?$/i.test(command) ||
+        /^(npx|pnpm\s+exec|yarn\s+exec|bunx)\s+(vitest|jest|playwright|cypress|tsc|eslint)(?:\s.*)?$/i.test(command));
+}
+export function isWithinRepo(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return (relative === "" ||
+        (!relative.startsWith("..") && !path.isAbsolute(relative)));
+}
+export function localScriptTarget(command) {
+    const args = normalizeVerifyCommandArgs(command.args);
+    const candidate = args.find((arg) => arg.replaceAll("\\", "/").startsWith("scripts/"));
+    return candidate?.replaceAll("\\", "/");
+}
+export function markdownVerifyCommand(repoRoot, command) {
+    const args = command.split(/\s+/).filter(Boolean);
+    if (args.length === 0 ||
+        args.some((arg) => !/^[a-z0-9@._/:=,+-]+$/i.test(arg))) {
+        return null;
+    }
+    return {
+        args,
+        cwd: repoRoot,
+        label: command,
+    };
+}
+export const MAX_INLINE_SOURCE_REFERENCE_DOCUMENTS = 8;
+export const MAX_SOURCE_EXCERPT_CHARS = 2000;
+export const REFERENCE_DIRECTORY = "references";
+export const REQUIREMENT_FILE = "需求.md";
+export function resolveDagVerifyStrategy(taskConfig, defaultIntermediateQuotaWhenFull = "full") {
+    const explicitIntermediateQuota = taskConfig.dagVerifyStrategy?.intermediateQuota;
+    return {
+        intermediateQuota: explicitIntermediateQuota ??
+            (taskConfig.verifyQuota === "full"
+                ? defaultIntermediateQuotaWhenFull
+                : taskConfig.verifyQuota),
+        finalQuota: "full",
+        focusedCommandSource: taskConfig.dagVerifyStrategy?.focusedCommandSource ?? "adapter",
+    };
+}
+export const SUCCESS_CRITERIA_SECTION = /##\s*(验收标准|完成标准|Acceptance(?:\s+References)?|Success Criteria)\s*\n([\s\S]*?)(?=\n##\s|\n#\s|$)/i;
+export function taskVerifyCommands(repoRoot, taskConfig) {
+    if (!repoRoot)
+        return [];
+    return taskConfig.verifyCommands.map((command) => ({
+        args: ["bash", "-lc", command.command],
+        cwd: repoRoot,
+        label: command.label,
+        timeoutMs: command.timeoutMs,
+    }));
+}
+export function toDagMavenVerificationPlan(plan, shellCommands) {
+    const shellCommandDigests = shellCommands?.map((command) => createHash("sha256").update(command).digest("hex")) ?? plan.shellCommandDigests;
+    return {
+        schemaVersion: plan.schemaVersion,
+        plannerVersion: plan.plannerVersion,
+        fingerprint: plan.fingerprint,
+        inputDigest: plan.inputDigest,
+        targets: plan.targets,
+        commandDigests: plan.commandDigests,
+        plannedCommands: plan.plannedCommands,
+        ...(plan.workspaceManifest
+            ? { workspaceManifest: plan.workspaceManifest }
+            : {}),
+        ...(shellCommandDigests && shellCommandDigests.length > 0
+            ? { shellCommandDigests }
+            : {}),
+    };
+}
+export function toDagSourcePath(sources, absolutePath) {
+    return serializeDagTaskSourcePath({
+        repoRoot: sources.repoRoot,
+        taskDir: sources.taskDir,
+        absolutePath,
+    });
+}
+export function verifyCommandKey(command) {
+    const normalizedArgs = normalizeVerifyCommandArgs(command.args);
+    const normalizedCwd = path.resolve(command.cwd).replace(/\\/g, "/");
+    const cwdKey = process.platform === "win32" ? normalizedCwd.toLowerCase() : normalizedCwd;
+    const envKey = Object.entries(command.env ?? {})
+        .filter((entry) => entry[1] !== undefined)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, value]) => `${key}=${value}`)
+        .join("\0");
+    return [cwdKey, normalizedArgs.join("\0"), envKey].join("\u0001");
+}
+export function vitestConfigExcludesDogfood(configPath, targets) {
+    if (!targets.some((target) => target.replace(/\\/g, "/").startsWith("dogfood/")))
+        return false;
+    try {
+        const text = readFileSync(configPath, "utf8");
+        return /exclude\s*:[\s\S]{0,500}dogfood\/\*\*/.test(text);
+    }
+    catch {
+        return false;
+    }
+}
+export function vitestTargetPaths(args) {
+    const targets = [];
+    let afterRun = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "run" || arg === "related") {
+            afterRun = true;
+            continue;
+        }
+        if (!afterRun || arg.startsWith("-")) {
+            if ((arg === "--config" || arg === "-c" || arg === "--reporter") && !arg.includes("="))
+                index += 1;
+            continue;
+        }
+        targets.push(arg);
+    }
+    return targets.filter((target) => target.includes("/") || /\.(?:test|spec)\.[^/]+$/.test(target));
+}
+export function normalizeVerifyCommandArgs(args) {
+    const [shell, flag, payload] = args;
+    if (args.length === 3 &&
+        shell !== undefined &&
+        payload !== undefined &&
+        /^(?:bash|sh)(?:\.exe)?$/i.test(path.basename(shell)) &&
+        flag === "-lc") {
+        const parsed = tokenizeSimpleShellCommand(payload);
+        if (parsed)
+            return normalizeVerifyCommandArgs(parsed);
+    }
+    return args.map((arg, index) => {
+        const normalized = arg.replace(/\\/g, "/");
+        return index === 0 && process.platform === "win32"
+            ? normalized.toLowerCase()
+            : normalized;
+    });
+}
+export function verifyCommandToShell(repoRoot, command) {
+    const relativeCwd = path.relative(repoRoot, command.cwd);
+    const cwdPrefix = relativeCwd &&
+        !relativeCwd.startsWith("..") &&
+        !path.isAbsolute(relativeCwd)
+        ? `cd ${shellQuote(relativeCwd)} && `
+        : command.cwd !== repoRoot
+            ? `cd ${shellQuote(command.cwd)} && `
+            : "";
+    const envPrefix = [
+        "HARNESS_ALLOW_ACTIVE_DAG_RUNS=1",
+        ...Object.entries(command.env ?? {}).map(([key, value]) => `${key}=${shellQuote(String(value))}`),
+    ].join(" ");
+    const commandText = command.args.map(shellQuote).join(" ");
+    return `${cwdPrefix}${envPrefix ? `${envPrefix} ` : ""}${commandText}`;
+}
+export function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+export const CHECK_REPO_COVERED_SCRIPTS = new Set([
+    "scripts/check-doc-links.sh",
+    "scripts/check-skill-entry.sh",
+    "scripts/check-init-surface.sh",
+]);
+export const REQUIREMENT_ID_DECLARATION_LINE = /^\s*(?:[-+*]\s+|\d+[.、)）]\s*|\|\s*)?(?:[-A-Z0-9]+\s*[::]\s*)?(?:\*\*)?(?:REQ|BR|AC)-/i;