cowork-flow 0.0.50 → 0.0.52

package/CHANGELOG.md

@@ -1,41 +1,85 @@
 # Changelog
 
-## 0.0.47 - 2026-08-05
+## 0.0.52 - 2026-08-26
 
-### Release readiness
+### ZCode 宿主与 hook 体验
 
-- Added `npm run release:check` as the documented local release confidence gate. It currently delegates to `npm run test:all`, which runs Node full tests, template full tests, and `pack:check`.
-- Added this changelog to summarize release highlights and publish-time verification notes.
+- 修复 hook 过期会话污染：按会话身份选取活动任务，全局兜底跳过失效绑定与 subagent 会话；显式身份无绑定时对齐 CLI 判 `no_task` 并列出可改绑活动任务。
+- 注册 zcode 为一等宿主平台：`host-assets.json` platforms 条目 + `adapters/zcode/adapter.yaml`，alias 解析、平台检测、adapter 一致性校验与 doctor 全链路覆盖；`.zcode/` 维持插件分发不落工程。
+- 纯 zcode 工程生命周期可用：技能落盘 `.cowork-flow/skills/`（宿主提示层仍由插件单源提供），内核 `skill_roots()` 解析 action owner；`detectAny` 增加 adapter 标记修复 sync 静默失养。
+- contract digest 注入瘦身：SessionStart（含 compact/clear）注入完整块，UserPromptSubmit 仅重复指纹行。
+- 新增 PostToolUse(Bash) 轮内刷新：生命周期命令落定后立即注入最新 workflow-state 与指纹行，无关命令零输出。
 
-### Runtime and workflow hardening
+### 运行时与诊断
 
-- Hardened runtime context lifecycle, recovery observability, and fixed-subagent binding diagnostics.
-- Added Batch execution inspect facts, stronger Host action result validation, and documented Batch recovery behavior.
-- Normalized runtime-health and task-review issue facts so review output is easier to consume.
+- 生命周期转换在提交单元内原子写 `.runtime/state-snapshot.json`；hook 在快照与所选任务一致时采用快照面包屑键，缺失或不一致回退 status 推导。Python 共享 hook 协议（build_hook_context）补直接单测。
+- doctor 新增会话卫生检查：报告失效任务绑定、超龄未活跃、不可读的运行时会话文件。
 
-### Host assets and integrations
+### 文档
 
-- Centralized Host Asset Manifest sync policy helpers and added a Host capability matrix contract.
-- Protected the ZCode multi-module scaffold boundary so plugin scaffolding does not vendor `.cowork-flow/` runtime files into module directories.
+- AGENTS.md 0.1 明确注入块优先、勿重复运行导航器；README 平台清单与技能分发表同步 zcode。
 
-### Party Mode
+## 0.0.51 - 2026-08-15
 
-- Extracted Party Mode board storage, enriched final report facts, and aligned Host action fallbacks with the capability matrix boundary.
-- Preserved the advisory-only contract: Party Mode does not advance task lifecycle state and does not replace implement/check review.
+### DSH host 接入
 
-### Sync, update, and support UX
+- 注册 DeepSeek Harness（dsh）host adapter 与平台标签映射（dsh_ context keys）。
+- 新增 `install-dsh-preset` 分发 DSH agent 预设；预设内置 workflow-state hook 插件，向系统提示注入与其它宿主同构的 `<workflow-state>` 块，每条用户消息刷新，生命周期命令落定后轮内刷新。
+- 补齐协议失败静默降级边界测试；记录 DSH 子代理绑定 field-test 路径（subagent init/bind/close）。
 
-- Added `sync --dry-run` readiness reports covering would-copy, protected skips, obsolete removals, Host asset refresh, pending recovery, and warnings.
-- Added `update --dry-run` readiness output so CLI updates can be previewed without installing.
-- Added the product support and troubleshooting playbook for task routing, runtime binding, Batch, Host asset drift, Party Mode, and release checks.
+### 计划绑定
 
-### Verification
+- `--from-plan` 支持绑定计划到 planning 任务（plan binding lite 收口），补 --from-plan help 与实际行为一致。
+- 归档任务快照绑定计划（snapshot bound plan into archived task）。
 
-- Release gate: `npm run release:check`
-- Formatting gate: `git diff --check`
-- Windows note: POSIX-shell-only release tests may be reported as skipped when POSIX shell is unavailable; skips must remain visible and must not be reported as passes.
+### 运行时与发布
 
-### Publish notes
+- `platform_from_context_key` 单源化并修复 zcode 平台漂移；zcode 会话上下文确定性解析；slug 前缀与任务 id/name 归一。
+- 共享 PYTHONPATH bootstrap；批量动作与 codex hook 在 Windows 通过 cmd wrapper 运行。
+- CI 在 Ubuntu/Windows 双平台跑全量 pytest；发布流程先同步 Skill replicas 再过全量门禁。
 
-- This entry documents the current `0.0.47` release candidate. It does not tag, publish, or bump the package version by itself.
-- Before publishing, confirm the version in `package.json`, `package-lock.json`, `template/.cowork-flow/.version`, and `template/.zcode/.zcode-plugin/plugin.json` matches the intended release.
+## 0.0.50 - 2026-08-10
+
+### 文档
+
+- task-review 技能把用户自定义 spec 明确为绑定义务（binding obligations）。
+
+## 0.0.49 - 2026-08-08
+
+### 计划与任务
+
+- 引入 plan binding lite：任务元数据绑定计划文件，Normal/High-risk 任务启动前校验计划与 decision anchor 就绪。
+- `task next` 暴露实现优先读上下文（implement read-first）；test-first 技能强化 red-green 指引。
+
+### 运行时与架构
+
+- 新增源码检出 source-refresh 命令；任务上下文服务模块化，lifecycle CLI adapter 瘦身；架构护栏测试固化边界。
+- 状态恢复诊断增强；host manifest 契约对齐；批量与 party 编排器模块化。
+- 保持 python 3.9 runner 兼容。
+
+### CI / 发布
+
+- 增加 Windows 发布信心门禁；发布验证测试稳定化。
+
+## 0.0.48 - 2026-08-05
+
+### 运行时与流程
+
+- 拆分 lifecycle 命令；route 契约收紧；runtime context 生命周期硬化，恢复元数据错误 fail-closed；subagent 运行错误码透出。
+- 移除 legacy changes control plane 与 add-session journal 工作流；guides 指引归入规划阶段。
+
+### Party Mode 与 Batch
+
+- 抽取 Party board 存储层；final report facts 丰富；host action fallback 对齐 capability matrix。
+- Batch 增加 inspect facts 与 host action 结果校验；恢复契约文档化。
+
+### Host 资产与健康
+
+- 新增 host capability matrix 契约；host-assets sync 策略集中；防止 ZCode scaffold 向模块目录泄漏流程文件。
+- task-review issue 与 runtime-health envelope 归一，review/health 输出更易消费。
+
+### 文档
+
+- README 项目概览刷新、任务流程图；产品故障排查 playbook；changelog 发布就绪说明。
+
+## 0.0.47 - 2026-08-05

package/README.md

@@ -12,7 +12,7 @@
 |---|---|
 | 任务流程 | `task next --json` 给出下一步 action，`task next --run` 只执行当前 action。 |
 | 运行健康 | `doctor` 诊断 runtime、host assets、Skill replica 和任务 hygiene，不推进生命周期。 |
-| Host 分发 | Host Asset Manifest 驱动 Codex / OpenCode / Claude Code / ZCode 资产和 obsolete 清理。 |
+| Host 分发 | Host Asset Manifest 驱动 Codex / OpenCode / Claude Code / ZCode / DeepSeek Harness 资产和 obsolete 清理。 |
 | 批处理与讨论 | Batch 发布 Host action；Party Mode 只输出 advisory final facts。 |
 | 发布准备 | `release:check`、`CHANGELOG.md`、`pack:check` 固定发布前证据。 |
 
@@ -58,11 +58,17 @@ cowork-flow update --dry-run
 # 安装 ZCode 插件（可选）
 cowork-flow install-zcode-plugin
 
+# 安装 DSH 预设（可选，整套 agent）
+cowork-flow install-dsh-preset
+
+# 机器级安装实时 workflow-state 注入（推荐：不换预设，任意 DSH 会话生效）
+cowork-flow install-dsh-hook
+
 # 维护者发布前检查
 npm run release:check
 ```
 
-平台选项：`codex` / `opencode` / `claude-code` / `all`（逗号分隔）
+平台选项：`codex` / `opencode` / `claude-code` / `dsh` / `zcode` / `all`（逗号分隔）
 
 ## 仓库结构
 
@@ -74,6 +80,7 @@ template/
 ├── .codex/                    # Codex agents / hooks / config
 ├── .claude/                   # Claude Code settings / agents / hooks
 ├── .opencode/                 # OpenCode agents / commands / plugins
+├── .dsh/                      # DeepSeek Harness 标记（sync 检测 + 说明）
 ├── .zcode/                    # ⭐ ZCode 插件（hooks + skills + agents + scaffold instructions）
 └── .cowork-flow/
     ├── config.yaml            # 项目配置
@@ -100,7 +107,9 @@ Skills 维护在 `template/skills/` 唯一源码，`init` / `sync` 时按目录
 | 平台 | 目标目录 |
 |---|---|
 | `codex` / `opencode` | `.agents/skills/` |
+| `dsh` | `.agents/skills/` |
 | `claude-code` | `.claude/skills/` |
+| `zcode` | `.cowork-flow/skills/`（内核 owner 解析用；系统提示层仍由 ZCode 插件单源提供，不重复加载） |
 
 分发动作：`adversarial-review`、`agent-dispatch`、`batch-execution`、`brainstorming`、`cowork-flow`、`cowork-flow-maintenance`、`decision-audit`、`failure-analysis`、`game-design`、`party-mode`、`python-runtime-design`、`runtime-health`、`spec-sync`、`task-planning`、`task-review`、`test-first`
 
@@ -112,13 +121,15 @@ Skills 维护在 `template/skills/` 唯一源码，`init` / `sync` 时按目录
 | `sync <path> [--dry-run]` | 同步已初始化项目的模板和技能 |
 | `source-refresh [path] [--dry-run]` | 维护者刷新 source checkout 的 ignored live runtime 与 Host Skill replica |
 | `install-zcode-plugin` | 安装 ZCode 插件到全局缓存 |
+| `install-dsh-preset` | 安装 DSH agent 预设到 `~/.dsh/.agent-presets/cowork-flow/`（整套 agent，可选） |
+| `install-dsh-hook` | 机器级注册 workflow-state hook 组合行到 `$DSH_HOME/cordis.patch.yml`（当前 DSH 的 agent 提示不收集 host 层 section，实时注入请用预设方式） |
 | `update [--dry-run]` | 升级 CLI 本身 |
 
 ### init 选项
 
 | 选项 | 说明 |
 |---|---|
-| `--platform <p>` | 平台：`codex` / `opencode` / `claude-code` / `all` |
+| `--platform <p>` | 平台：`codex` / `opencode` / `claude-code` / `dsh` / `zcode` / `all` |
 | `--developer <n>` | 开发者名称 |
 | `--force` | 覆盖已有文件 |
 | `--dry-run` | 预览不写入 |
@@ -161,7 +172,7 @@ ZCode 插件只安装 hook、skills、agents 和轻量说明文件；`.cowork-fl
 
 **Hook 注入内容：**
 - `workflow-state` — 当前任务状态
-- `contract-digest` — 合同摘要（SHA256 fingerprint）
+- `contract-digest` — 合同摘要：SessionStart 注入完整块，后续消息仅重复 SHA256 fingerprint
 - `delegated_subtask` — 子代理运行时上下文
 
 **插件子代理：**
@@ -169,6 +180,35 @@ ZCode 插件只安装 hook、skills、agents 和轻量说明文件；`.cowork-fl
 - `cowork-check` — 绑定 runtime context 后做独立检查
 - `cowork-research` — 绑定 runtime context 后做只读调研
 
+## DSH 接入
+
+```bash
+cowork-flow init ./my-project --platform dsh   # 项目资产：AGENTS.md + .agents/skills/ + .dsh 标记
+cowork-flow install-dsh-hook                   # 机器级：注册 hook 组合行（实时注入见下方说明）
+```
+
+`install-dsh-hook` 把 `workflow-state.js` 插件作为 `insert:` patch 注册到 `$DSH_HOME/cordis.patch.yml`（未设置 `DSH_HOME` 时默认 `~/.dsh`），组合层面可被 `dsh --dump-config` 验证。经实测（DSH 0.1.1-rc.1），**agent 提示组装不收集 host 层 section**：该组合行不会在会话系统提示中产生 `<workflow-state>` 块。当前 DSH 版本下实时注入仍需预设方式（`install-dsh-preset`）；本命令保留为组合层面的幂等注册能力（卸载见下），待 DSH 支持 agent-scope patch / workspace 级组合后可直接生效（见 `docs/dsh-upstream-proposal.md`）。
+
+在未安装 cowork-flow 的项目里 hook 完全无感：JS 侧根目录预检直接短路——不注入内容、不启动 Python 进程。全局开关（环境变量）：`COWORK_FLOW_HOOKS=0` / `COWORK_FLOW_DISABLE_HOOKS=1`。卸载：`cowork-flow install-dsh-hook --uninstall`（`--force` 同时删除插件文件）。
+
+> 安装或更新后需要**重启 DSH**（`cordis.patch.yml` 在启动时组合，新增/变更不会被热加载）。
+
+> 使用预设（`install-dsh-preset`）时无需再运行 `install-dsh-hook`——预设已内置同一 hook。
+
+## DSH 预设
+
+```bash
+cowork-flow install-dsh-preset            # 安装
+cowork-flow install-dsh-preset --force    # 覆盖已安装
+cowork-flow install-dsh-preset --dry-run  # 预览不写入
+```
+
+安装到 `~/.dsh/.agent-presets/cowork-flow/`（`DSH_HOME` 存在时以其为准）：`agent.cordis.yml` + `preset.yml` + 全部流程技能。安装后在 DeepSeek Harness 中新建会话并选择 **Cowork Flow** 预设即可使用：persona 携带流程门禁规则，技能目录随预设挂载，不依赖项目本地副本。
+
+预设组合是部署 `standard` 预设的拷贝 + 最小改动（persona 流程规则、`skill-filesystem` 指向预设自带 `skills/`）；`cowork-flow init --platform dsh` 仍负责项目级资产（`AGENTS.md`、`.agents/skills/`、`.dsh/` 标记）。
+
+预设内置 **workflow-state hook**（`plugins/workflow-state.js`）：DSH 原生等效于 Codex/Claude hook，向系统提示末尾注入与其它宿主同构的 `<workflow-state>` 块，每条用户消息刷新一次，并在生命周期命令（`task`/`subagent`/`resume`）执行完成后立即轮内刷新（替换语义，不累积）。项目无 `.cowork-flow` 根、缺少 Python 或设 `COWORK_FLOW_HOOKS=0` / `COWORK_FLOW_DISABLE_HOOKS=1` 时静默降级，由 AGENTS.md 门禁的运行导航器兜底。
+
 ## 任务流程
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-flow",
-  "version": "0.0.50",
+  "version": "0.0.52",
   "description": "CLI for installing and maintaining cowork-flow collaboration templates.",
   "type": "module",
   "bin": {
@@ -11,6 +11,7 @@
     "src",
     "template",
     "template/.zcode",
+    "presets",
     "README.md",
     "CHANGELOG.md",
     "!template/**/__pycache__/**",

package/presets/dsh/agent.cordis.yml

@@ -0,0 +1,206 @@
+# The `cowork-flow` agent preset: the standard coding agent plus the
+# cowork-flow workflow framework (task gate, planning, fixed subagents, skills).
+#
+# This file is a copy of the deployment's `standard` preset with two changes:
+# the persona carries cowork-flow operating rules, and `skill-filesystem`
+# points at this preset's own `skills/` directory (installed alongside by
+# `cowork-flow install-dsh-preset`).
+#
+# The `dsh` host adapter lives in the cowork-flow repository
+# (template/.cowork-flow/adapters/dsh/adapter.yaml) and declares this preset's
+# capability model; this file is the DSH-side composition it describes.
+
+# ── identity ────────────────────────────────────────────────────────────────
+
+- id: persona
+  name: '@deepseek-ai/dsh-persona'
+  config:
+    text: >-
+      You are a coding agent powered by the {{model}} model. Your working directory is {{cwd}}.
+
+      你运行在 cowork-flow 流程框架上。项目已接入时，工作区 AGENTS.md 的"0.1 编码前强制门禁"生效：编辑文件、变更代码、派发子代理之前，先确定当前工作流状态（系统提示含 <workflow-state> 块则按其路由，否则运行 ./.cowork-flow/run task next），再决定放行、阻断还是路由；no_task / planning / completed 状态阻断写代码。只读问答、纯查询命令、用户明确说"跳过流程"时豁免。
+
+      子代理身份由 runtime context 绑定决定，不由 prompt 推断：固定子代理（cowork-implement / cowork-check / cowork-research）按 agent-dispatch 技能执行 subagent bind / close，未绑定时禁止 start / resume / archive / commit / 派发 agent。
+
+      项目流程以 task next、runtime gate、Skill command manifests 和 .cowork-flow/spec/ 硬契约为准；不要维护第二套流程文档或 Skill 注册控制面。文档语言中文；提交策略允许 AI 提交。
+
+- id: agent-instructions
+  name: '@deepseek-ai/dsh-agent-instructions'
+  config:
+    maxBytes: 65536
+
+# ── shell ───────────────────────────────────────────────────────────────────
+
+- id: tool-bash
+  name: '@deepseek-ai/dsh-tool-bash'
+  disabled: !!js process.platform === 'win32'
+
+- id: tool-pwsh
+  name: '@deepseek-ai/dsh-tool-pwsh'
+  disabled: !!js process.platform !== 'win32'
+
+# ── filesystem ──────────────────────────────────────────────────────────────
+
+- id: tool-fs
+  name: '@deepseek-ai/dsh-tool-fs'
+
+- id: tool-fs-search
+  name: '@deepseek-ai/dsh-tool-fs-search'
+  config:
+    sampleOverCapGlobResults: false
+
+# ── background jobs ────────────────────────────────────────────────────────
+
+- id: tool-jobs
+  name: '@deepseek-ai/dsh-tool-jobs'
+
+# ── skills ──────────────────────────────────────────────────────────────────
+
+# The skill REGISTRY lives in the host composition and is layered per scope:
+# these rows register into THIS preset's layer of it. `skill-filesystem`
+# contributes the cowork-flow skills shipped with this preset (`customSkillDirs`,
+# resolved against the preset's own directory via `baseUrl`) on top of the
+# local-root discovery for the current workspace.
+- id: skill-filesystem
+  name: '@deepseek-ai/dsh-skill-filesystem'
+  config:
+    customSkillDirs:
+      - !!js "process.getBuiltinModule('node:url').fileURLToPath(new URL('skills/', baseUrl))"
+
+- id: tool-skill
+  name: '@deepseek-ai/dsh-tool-skill'
+
+# ── workflow state hook ────────────────────────────────────────────────────
+# DSH-native equivalent of the Codex/Claude hooks: registers a system-prompt
+# section (rendered last) that carries the `<workflow-state>` block, refreshed
+# per user message. Consumes the host `systemPrompt` registry and publishes
+# nothing, so it sits loose like the tool rows above.
+- id: workflow-state-hook
+  name: './plugins/workflow-state.js'
+
+# ── goals ───────────────────────────────────────────────────────────────────
+
+- id: tool-goal
+  name: '@deepseek-ai/dsh-tool-goal'
+
+# ── plan mode ───────────────────────────────────────────────────────────────
+
+- id: planning
+  name: cordis:group
+  group: true
+  isolate:
+    planMode: true
+  config:
+    - id: plan-mode
+      name: '@deepseek-ai/dsh-plan-mode'
+      config:
+        section: |
+              You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+              Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+              The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed to keep the tool catalog unchanged. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+              Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+              Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+              When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+
+# ── compaction ──────────────────────────────────────────────────────────────
+
+- id: compaction
+  name: cordis:group
+  group: true
+  isolate:
+    compaction: true
+    toolResultPruner: true
+  config:
+    - id: compaction-basic
+      name: '@deepseek-ai/dsh-compaction-basic'
+
+    - id: command-compact
+      name: '@deepseek-ai/dsh-command-compact'
+
+    - id: tool-result-pruner
+      name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+      config:
+        thresholdChars: 8192
+        headChars: 4096
+        tailChars: 1024
+
+# ── delegation and workflows ────────────────────────────────────────────────
+
+- id: delegation
+  name: cordis:group
+  group: true
+  isolate:
+    workflowEngine: true
+  config:
+    - id: tool-subagent-control
+      name: '@deepseek-ai/dsh-tool-subagent-control'
+
+    - id: tool-subagent-list-agents
+      name: '@deepseek-ai/dsh-tool-subagent-control/list-agents'
+
+    - id: tool-subagent
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: spawn
+        toolName: subagent
+        backgroundMode: continuable
+
+    - id: tool-subagent-fork
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: fork
+        toolName: subagent_fork
+        backgroundMode: continuable
+
+    - id: tool-subagent-codex
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: codex
+        toolName: subagent_codex
+        enableRunInBackground: false
+        maxDepth: provider-managed
+
+    - id: tool-subagent-claude-code
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: claude-code
+        toolName: subagent_claude_code
+        enableRunInBackground: false
+        maxDepth: provider-managed
+
+    - id: workflow-worker-thread
+      name: '@deepseek-ai/dsh-workflow-worker-thread'
+      config:
+        provider: spawn
+
+    - id: tool-workflow
+      name: '@deepseek-ai/dsh-tool-workflow'
+
+    - id: tool-ralph
+      name: '@deepseek-ai/dsh-tool-ralph'
+      config:
+        subagentProvider: spawn
+        maxRounds: 64
+
+# ── remaining model-facing rows ─────────────────────────────────────────────
+
+- id: tool-ask-user
+  name: '@deepseek-ai/dsh-tool-ask-user'
+
+- id: tool-todo
+  name: '@deepseek-ai/dsh-tool-todo'
+  config:
+    allowParallelInProgress: true
+
+- id: tool-web
+  name: '@deepseek-ai/dsh-tool-web'
+  config:
+    fetch: false
+    searchTimeoutMs: 60000