agent-trellis 0.19.0 → 0.20.0

package/dist/cli.js

@@ -18,6 +18,10 @@ import { runMcpAuth } from "./commands/mcpAuth.js";
 import { runMcpRenew } from "./commands/mcpRenew.js";
 import { runSecretsAudit } from "./commands/secretsAudit.js";
 import { runRollback } from "./commands/rollback.js";
+// consumer-wiring(8.7):`trellis evolve` 管理面挂载。这条 import 是
+// 托管层仅有的消费者接线,登记在 test/unit/hostingIndependence.test.ts
+// 的 CONSUMER_WIRING;物理移出自我进化时与下文 evolve 分支一并删除。
+import { runEvolveCommand } from "./commands/evolve.js";
 import { runSkillList, runSkillAdd, runSkillRemove, runSkillScope, runSkillUpdateBuiltin } from "./commands/skill.js";
 import { runRemoteSkillAdd, runRemoteSkillList, runRemoteSkillUpdate } from "./commands/remoteSkill.js";
 import { collectMemoryList, runMemoryExtraction, runMemorySync } from "./commands/memory.js";
@@ -26,7 +30,7 @@ import { runKimi } from "./commands/kimi.js";
 import { TRELLIS_VERSION } from "./lib/cliMetadata.js";
 import { flagValue } from "./lib/cliArgs.js";
 import { parseSyncArgs } from "./lib/syncArgs.js";
-const KNOWN_COMMANDS = ["onboard", "init", "migrate", "doctor", "sync", "mcp", "mcp-gateway", "mcp-runtime", "skill", "add", "update", "memory", "manage", "kimi", "secrets", "rollback"];
+const KNOWN_COMMANDS = ["onboard", "init", "migrate", "doctor", "sync", "mcp", "mcp-gateway", "mcp-runtime", "skill", "add", "update", "memory", "manage", "kimi", "secrets", "rollback", "evolve"];
 function printUsage() {
     console.log(`trellis - a single source of capability for every coding agent
 
@@ -625,6 +629,13 @@ async function main(argv) {
         process.exitCode = exitCode;
         return;
     }
+    if (command === "evolve") {
+        // 自我进化管理面(trellis-evolve 12.4):批准仅限交互式终端,由
+        // runEvolveCommand 内部检测;argv 原样传入,不拼 shell。
+        const { exitCode } = await runEvolveCommand(rest);
+        process.exitCode = exitCode;
+        return;
+    }
     console.error(`\`trellis ${command}\` is not implemented yet — this is a pre-alpha scaffold.\nSee docs/roadmap.md for status.`);
     process.exitCode = 1;
 }

package/dist/commands/doctor.d.ts

@@ -8,6 +8,7 @@ import { loadCanonicalSource } from "../core/canonical.js";
 import type { AgentId, AgentSnapshot, CanonicalSource } from "../core/types.js";
 import { type VersionExecutor } from "../lib/cliEntrypoints.js";
 import { type WorkspaceDoctorSection } from "../lib/workspaceDoctor.js";
+import { type EvolveLevelSection } from "../host/levels.js";
 /**
  * Interim default until P1 wires this from `.trellis/mcp/servers.yaml`'s
  * real `known_host_injected` field (P0 has no canonical source at all —
@@ -74,6 +75,13 @@ export interface DoctorReport {
     /** Per-entry layer attribution when a `.agents/` workspace layer
      * participated (trellis-workspace-scope task 3.5). */
     workspace?: WorkspaceDoctorSection;
+    /** Self-evolution levels when `~/.trellis/evolve.yaml` has any explicit
+     * setting (trellis-evolve task 10.2). Absent when unconfigured — a
+     * machine that never enabled evolution sees byte-identical output. */
+    evolve?: EvolveLevelSection;
+    /** Pending proposal count (trellis-evolve task 12.4; spec: doctor SHALL
+     * list it). Present when > 0 or the evolve section is shown. Read-only. */
+    evolvePending?: number;
 }
 /** Exported so tests can assert on this resolution directly, without
  * routing through real per-agent probes `runDoctor` also runs. */

package/dist/commands/doctor.js

@@ -4,6 +4,8 @@
  * current state against each other, the same manual process used
  * throughout docs/research.md's investigation, now formalized.
  */
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 import { homedir } from "node:os";
 import * as claudeCodeProbe from "../probes/claude-code.js";
 import * as codexProbe from "../probes/codex.js";
@@ -13,12 +15,43 @@ import * as kimiCodeProbe from "../probes/kimi-code.js";
 import * as zcodeProbe from "../probes/zcode.js";
 import { loadCanonicalSource } from "../core/canonical.js";
 import { GATEWAY_ENTRY_NAME, RUNTIME_ENTRY_NAME, resolveMcpPlan } from "../adapters/mcpPlan.js";
-import { ALL_AGENTS, isOAuthAuth, oauthOwner } from "../core/types.js";
+import { ALL_AGENTS, capabilityDeliveryForAgent, isOAuthAuth, oauthOwner } from "../core/types.js";
 import { classifyStoredToken, remediationFor } from "../lib/oauth/renew.js";
 import { readToken } from "../lib/oauth/store.js";
 import { findWorkspaceRoot } from "../lib/workspace.js";
 import { detectCliVersionSplit, findCliEntrypoints } from "../lib/cliEntrypoints.js";
 import { collectWorkspaceDoctorSection } from "../lib/workspaceDoctor.js";
+import { describeEvolveLevels, loadEvolveLevelPolicy, } from "../host/levels.js";
+/**
+ * Pending proposal count via the on-disk data contract (8.1 状态目录 /
+ * 12.4 pending 存储:`~/.trellis/evolve/pending/<safeId>.json`,记录含
+ * `status` 字段)。doctor 属托管层,只读数据、不 import 自我进化代码,
+ * 物理移出消费者后 doctor 仍自洽(目录不存在 → 0)。
+ */
+function countPendingProposalRecords(homeDir) {
+    const dir = join(homeDir, ".trellis", "evolve", "pending");
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        return 0;
+    }
+    let count = 0;
+    for (const name of names) {
+        if (!name.endsWith(".json"))
+            continue;
+        try {
+            const parsed = JSON.parse(readFileSync(join(dir, name), "utf-8"));
+            if (parsed.status === "pending")
+                count += 1;
+        }
+        catch {
+            // 坏文件不阻塞 doctor 扫描。
+        }
+    }
+    return count;
+}
 /**
  * Interim default until P1 wires this from `.trellis/mcp/servers.yaml`'s
  * real `known_host_injected` field (P0 has no canonical source at all —
@@ -183,7 +216,39 @@ export async function collectDoctorReport(homeDir = homedir(), knownHostInjected
     }
     const oauth = canonical ? collectOAuthHealth(homeDir, canonical) : [];
     findings.push(...detectDuplication(snapshots), ...detectCollisions(snapshots, knownHostInjected), ...detectCrossAgentDrift(snapshots), ...detectCaseMismatches(snapshots), ...detectParseDiagnostics(snapshots), ...(canonical ? detectRuntimeDrift(snapshots, canonical) : []), ...detectMcpUnreachable(snapshots), ...oauth.flatMap((entry) => (entry.status === "valid" ? [] : [oauthFinding(entry)])));
-    return { snapshots, findings, ...(oauth.length > 0 ? { oauth } : {}), ...(workspace ? { workspace } : {}) };
+    // 分级开启(trellis-evolve 10.2):级别策略是显式用户选择,读取零副作用。
+    // 未配置(或全空)时整段缺席 —— 从未开启自我进化的机器输出与未安装时
+    // 一致;损坏的策略文件不拖垮扫描,降级为段内诊断呈现。
+    let evolve;
+    try {
+        const policy = loadEvolveLevelPolicy(homeDir);
+        // 整段只在存在显式设置时出现(与未安装时输出一致);托管 agent 的
+        // 列表只是展示面,不构成出现理由。
+        const hasExplicitSetting = policy.defaultLevel !== undefined || Object.keys(policy.agents).length > 0 || Object.keys(policy.workspaces).length > 0;
+        if (hasExplicitSetting) {
+            // 11.4:观测形态按 capability delivery 分类——runtime 交付
+            // ("mcp"/"both")的 agent 走 gateway 事件观察;仅原生渲染
+            // ("native"/未配置)只有 doctor/sync 信号。
+            const observationOf = (agent) => canonical !== undefined && capabilityDeliveryForAgent(agent, canonical.mcp) !== "native"
+                ? "events"
+                : "doctor-only";
+            evolve = describeEvolveLevels(policy, (canonical?.managedAgents ?? []).map((agent) => ({ agent, observation: observationOf(agent) })));
+        }
+    }
+    catch (err) {
+        evolve = { agents: [], workspaces: [], diagnostics: [err.message] };
+    }
+    // 12.4:pending 提案数量(spec "trellis doctor SHALL 同样列出")。
+    // 只读状态目录;未开启进化且无存储时为 0,输出保持零噪音。
+    const evolvePending = countPendingProposalRecords(homeDir);
+    return {
+        snapshots,
+        findings,
+        ...(oauth.length > 0 ? { oauth } : {}),
+        ...(workspace ? { workspace } : {}),
+        ...(evolve ? { evolve } : {}),
+        ...(evolve || evolvePending > 0 ? { evolvePending } : {}),
+    };
 }
 /**
  * Read-only OAuth credential health (trellis-mcp-oauth-renew design.md
@@ -463,4 +528,24 @@ export function printReport(report) {
             console.log(`   ⚠ ${warning}`);
         }
     }
+    if (report.evolve) {
+        const ev = report.evolve;
+        console.log(`\nSelf-evolution (evolve.yaml):`);
+        if (ev.defaultLevel !== undefined)
+            console.log(`   default level: ${ev.defaultLevel}`);
+        for (const entry of ev.agents) {
+            console.log(`   agent ${entry.agent}: ${entry.level} (${entry.observation})`);
+        }
+        for (const entry of ev.workspaces) {
+            console.log(`   workspace ${entry.root}: ${entry.level}`);
+        }
+        for (const diagnostic of ev.diagnostics) {
+            console.log(`   ⚠ ${diagnostic}`);
+        }
+        console.log(`   pending proposals: ${report.evolvePending ?? 0}`);
+    }
+    else if ((report.evolvePending ?? 0) > 0) {
+        // 无级别配置但有 pending 存储:同样列出(spec SHALL),单行提示。
+        console.log(`\nSelf-evolution: ${report.evolvePending} pending proposal(s) — run \`trellis evolve pending\``);
+    }
 }

package/dist/commands/evolve.d.ts

@@ -0,0 +1,43 @@
+/**
+ * 自我进化管理面命令(trellis-evolve 任务 12.4)。
+ *
+ * 消费者归属(8.7):本文件是自我进化子系统的一部分,物理移出消费者时
+ * 与 src/evolve/**、CLI 挂载(src/cli.ts 的 CONSUMER_WIRING 接线行)一并
+ * 删除;hostingIndependence.test.ts 的 CONSUMER_OWNED/CONSUMER_WIRING
+ * 登记了这条移出清单。
+ *
+ * `trellis evolve <status | report | pending | approve | reject | apply | run | import | enable | disable | rollback>`
+ *
+ * 批准只走这里,且**仅限交互式终端**(spec"批准只走带外通道"):非交互
+ * 环境一律拒绝,提案保持 pending。不存在任何 `--yes` / `--confirm` 之类的
+ * 非交互批准捷径 —— agent 传入的"确认"参数不构成批准,加了也只会被当
+ * 未知参数忽略。循环副作用边界:除 `run`(唯一命令行触发入口,手动
+ * 触发一次运行)外的命令不写信号、不触发观察/提案/probe。approve
+ * 决策后**立即应用**(spec"批准即应用与显式应用入口":持单飞作业锁经
+ * 备份会话写入,锁忙暂缓并告知);apply 幂等应用全部已批准未应用的编辑
+ * (失败重试与滞留消化入口);reject 只做状态迁移 + 档案;enable/disable
+ * 写 canonical 级别策略,并按 design 8.1 同步扩展清单条目——级别升至
+ * observe 及以上时写入、置回 off 时移除;rollback 转发既有备份会话回滚。
+ */
+import { type ApplyAgent } from "../evolve/apply.js";
+export interface EvolveCommandOptions {
+    /** 测试/sandbox 注入缝;缺省用户 HOME。永不作为 CLI 标志暴露。 */
+    readonly homeDir?: string;
+    /** TTY 检测缝;缺省 stdin+stdout 同时为 TTY。 */
+    readonly isTTY?: boolean;
+    /** 时间源(毫秒);缺省 Date.now。 */
+    readonly now?: () => number;
+    /** 应用阶段的 agent 分类(测试/sandbox 注入缝;缺省按 delivery 分类)。 */
+    readonly applyAgents?: readonly ApplyAgent[];
+    /** 原生渲染同步触发缝(测试注入;缺省 host `triggerRenderSync`)。 */
+    readonly triggerSync?: () => Promise<{
+        exitCode: number;
+    }>;
+}
+/**
+ * 管理面命令入口。`args` 为 `evolve` 之后的 argv(子命令 + 参数),
+ * 由 cli 原样传入 —— 不经 shell 拼接。
+ */
+export declare function runEvolveCommand(args: readonly string[], options?: EvolveCommandOptions): Promise<{
+    exitCode: number;
+}>;