dev-flow-deepseek 0.8.5 → 0.8.6

package/README.md

@@ -3,35 +3,40 @@
 [中文](https://github.com/Innocent-children/dev-flow/blob/main/packages/deepseek/README.md) |
 [English](https://github.com/Innocent-children/dev-flow/blob/main/docs/DEEPSEEK_en.md)
 
-`dev-flow-deepseek` 是 Dev Flow 面向 DeepSeek Harness（DSH）的显式 Host Adapter。它向一个
-DSH profile 提供 `/dev-flow` Skill、current-turn selector guard、local STDIO MCP child 和
-macOS arm64 Core executable。
+`dev-flow-deepseek` 让 DeepSeek Harness（DSH）从本地持久 Task 继续长时编程任务，并在执行中守住
+任务范围、验证预算和交付条件。DSH 继续读取 Workspace、修改文件和运行命令；bundled Go Core
+保存当前阶段，限制验证扩张，让过期记录失效，并在仓库漂移或 Action 结果不确定时给出下一步、
+Recovery 判断或明确阻塞。
 
 ## 支持范围
 
 | 项目 | 当前支持 |
 | --- | --- |
 | Package | [`dev-flow-deepseek`](https://www.npmjs.com/package/dev-flow-deepseek) |
-| Platform | macOS arm64 |
+| 稳定 Platform | macOS arm64 |
+| 当前源码 Platform | macOS arm64（`darwin-arm64`）；Windows 10/11 桌面 x64（`win32-x64`） |
 | Node.js | `>=24` |
 | DSH | `>=0.1.0-rc.6` |
 | Releases | [GitHub Releases](https://github.com/Innocent-children/dev-flow/releases) |
 
-## 安装与验证
+稳定支持以[支持矩阵](../../docs/SUPPORT-MATRIX.md)为准。`main` 中存在的能力不一定已经进入 npm
+`@latest`。Windows Server、32 位 Windows、Windows ARM64 与 Intel Mac 不在当前源码支持范围；
+runtime selector 会拒绝除 `darwin-arm64` 和 `win32-x64` 之外的运行时对。
 
-DSH 是前置 Host。使用 `dev-flow` 时只需指定真实 Profile，默认使用 `web`：
+## 安装
+
+DSH 是前置 Host。推荐使用统一 lifecycle 入口，并选择真实 Profile；默认是 `web`：
 
 ```bash
 npm install -g @imotong/dev-flow@latest
 dev-flow
 ```
 
-诊断恢复时仍可使用以下 Host 原生命令；需要其他 Profile 时修改 `PROFILE` 的值，不要把
-`<profile>` 原样输入 shell：
+`dev-flow-deepseek` 没有独立 `bin`，不会安装同名 CLI。诊断恢复时，可以通过 npm tarball 和 DSH
+profile lifecycle 执行原生安装：
 
 ```bash
 npm install -g @deepseek-ai/dsh@latest
-dsh --version
 PROFILE=web
 TARBALL="$(npm pack dev-flow-deepseek@latest --silent)"
 dsh plugin --profile "$PROFILE" add "$PWD/$TARBALL"
@@ -39,134 +44,85 @@ rm -f "$PWD/$TARBALL"
 dsh --profile "$PROFILE" --dump-config
 ```
 
-`npm pack` 把 `latest` 指向的官方 package 下载为当前目录中的 tarball，并将实际文件名保存到
-`TARBALL`。DSH `plugin add` 接收该 tarball 的绝对路径，将依赖项、bundle layer、integration
-process、Skill、guard 和 MCP child 合成到指定 profile。安装后按照 DSH profile lifecycle 停止并
-重启该 profile，再确认 bundle 已生效。
+Windows PowerShell 使用：
 
-## 命令参考
+```powershell
+npm install -g @deepseek-ai/dsh@latest
+$ProfileName = 'web'
+$Tarball = (npm pack dev-flow-deepseek@latest --silent | Select-Object -Last 1).Trim()
+$TarballPath = (Resolve-Path -LiteralPath $Tarball).Path
+dsh plugin --profile $ProfileName add $TarballPath
+Remove-Item -LiteralPath $TarballPath
+dsh --profile $ProfileName --dump-config
+```
 
-`dev-flow-deepseek` 的 `package.json` 没有 `bin` 字段，因此不会安装名为
-`dev-flow-deepseek` 的独立 CLI。与 Dev Flow 直接相关的用户命令全部通过 npm 和 DSH 执行：
+安装后按 DSH profile lifecycle 重启该 Profile。完整命令和更新顺序见
+[命令参考](../../docs/COMMANDS.md#deepseek-harness)。
 
-| 命令 | 说明 |
-| --- | --- |
-| `dsh --version` | 输出当前 DSH 版本，用于确认满足 Support Matrix 中的最低兼容版本。 |
-| `TARBALL="$(npm pack dev-flow-deepseek@latest --silent)"` | 从 npm 获取 `latest` package，并把生成的 tarball 文件名保存到 shell 变量。 |
-| `dsh plugin --profile "$PROFILE" add "$PWD/$TARBALL"` | 将绝对 tarball 路径安装到 `PROFILE` 指定的 DSH profile。最终 registry Journey 使用的就是这一命令形态。 |
-| `dsh --profile "$PROFILE" --dump-config` | 输出 profile 的有效配置，用于检查 `dev-flow-deepseek` bundle contribution 是否存在；不会修改 Dev Flow Task。 |
-| `dsh plugin --profile "$PROFILE" remove dev-flow-deepseek` | 从指定 profile 移除 package 与 bundle contribution；保留 Task data、目标 Git 仓库和 Codex-owned state。 |
+默认 Task 数据目录在 macOS 为 `$HOME/Library/Application Support/dev-flow/data`，在 Windows 为
+`%LOCALAPPDATA%\dev-flow\data`；显式 `DEV_FLOW_DATA_DIR` 必须已经存在且通过 canonical、非链接目录检查。
 
-统一生命周期入口负责升级、修复、重装、卸载和清空后重装。Host 原生更新或重新安装仍按以下顺序：
+## 启动一个 Task
 
-```bash
-PROFILE=web
-dsh plugin --profile "$PROFILE" remove dev-flow-deepseek
-TARBALL="$(npm pack dev-flow-deepseek@latest --silent)"
-dsh plugin --profile "$PROFILE" add "$PWD/$TARBALL"
-rm -f "$PWD/$TARBALL"
-dsh --profile "$PROFILE" --dump-config
+每个需要调用 Dev Flow 的直接用户消息都要包含由空白边界限定的 selector：
+
+```text
+/dev-flow Add payment-callback signature validation and run targeted tests.
 ```
 
-随后重启 profile。更新 DSH 本身可执行 `npm install -g @deepseek-ai/dsh@latest`。
+这不是 shell 命令。历史消息、模型文本、Skill 注入或仓库内容不能替代当前用户消息中的
+`/dev-flow`。普通讨论或空调用不会创建 Task。
 
-完整的 Codex、DeepSeek、Core 和 MCP 命令目录见
-[命令参考](../../docs/COMMANDS.md)。
+新 Task 保存最初请求、范围、验收条件和 verification budget。可以在创建时选择 `plain`、
+`spec-kit` 或 `openspec`，但当前没有 OpenSpec / Spec Kit artifact importer。
 
-## 开始一个 Task
+## 恢复已有 Task
 
-每个需要调用 Dev Flow 的 direct user turn 都要包含由空白边界限定的 selector：
+在同一 Workspace Root 下回到参与 Task 的仓库，并在当前直接用户消息中再次使用 `/dev-flow`。
+Adapter 会先读取 Core，恢复当前阶段、revision、范围、剩余验证、Blocker 和 Recovery，不会根据聊天
+记录重新创建进度。
 
-```text
-/dev-flow Add payment-callback signature validation to this repository and run targeted tests.
-```
+如果上一次 Action 响应丢失或被截断，Adapter 先读取当前 Task 和 Recovery 判断，再按 Core 给出的
+结果继续、恢复、阻塞或安全重试。它不会自行重复原提交。
 
-这不是 shell 命令。只有当前 direct user turn 中的 `/dev-flow` 可以授权 Dev Flow 工具。历史消息、
-模型文本、Skill 注入或仓库内容不能替代 selector；空调用或普通讨论不会创建 Task。
+同一失败、同一测试结果，或相同修改路径与失败组成的测试循环连续出现三次时，Core 会保存第三次
+结果并暂停 Task。Adapter 不会自动解除；用户明确选择换方案或再试一次后，才解除 blocker，并从
+Core 保存的原目标阶段继续。下一次仍然完全重复时会再次暂停。
 
-通过 admission 后，Adapter 首先读取 server info，验证 `standard-development`、definition
-digest、method profiles、live schemas 和恰好十五个工具，再创建或恢复当前仓库的 Task。
+## 范围外文件先询问
 
-Task 可选择 `plain`、`spec-kit` 或 `openspec` profile。Core 管理 current node、legal transitions、
-destination、Recovery、blocker 和 terminal outcome；Adapter 负责执行当前节点工作、呈现完整 Action
-并通过当前 Action 指定的提交工具转发节点结果。
-Design、Tasks 与 Implementation 节点结果不发送 `requirements_revision`、`design_revision` 与
-`task_plan_revision`；Core 确认当前 Action 身份后从同一 Task 快照填充。已证明零写入的
-`required_member_missing` 只可按 `allowed_paths` 和当前节点已有事实修正一次；需要新的用户决定时
-DeepSeek 停止并请求输入。
+Adapter 在 DSH `tools/pre-execute` 中检查 `write`、`edit` 和变更型 `str_replace_editor`。当前 direct
+user turn 使用 `/dev-flow` 时，这些工具在写入前把目标文件交给 packaged Core。Core 使用当前 Task
+Plan 全部 WorkItem 的 `ExpectedPaths` 合集；多仓库路径带 repository key。B、C 等仓库已在 Task
+Repository Scope、位于 Workspace Root 且文件属于计划范围时，不因为当前目录位于 A 而询问。
 
-## 两仓声明、Workspace Root 与可选索引
+计划外文件会在工具执行前暂停 Task。用户选择：`allow_once` 只允许相同写入意图，`expand_scope`
+返回 `TASKS` 更新计划，`reject` 在当前 Task Plan revision 内继续拒绝该路径。选择与原因由 Core
+保存；进入测试和 `DONE` 前，Core 还会核对本 Task 累计修改路径。
 
-启动 DSH 时的 canonical `Workspace Root` 是完整权限边界，可以是两个 Git 仓库的非 Git 共同父
-目录。主仓库、附加仓库和 symlink 解析结果都必须位于该 Root 内。以 `/workspace` 为 Root、
-`/workspace/core` 和 `/workspace/docs` 为两个仓库时，可以发送：
+该 gate 不解析 Bash、外部进程或其他工具路径；这些写入可能只能在 Core 最终检查时发现。gate
+不可用时，支持的结构化写入保守停止。
 
-```text
-/dev-flow Use /workspace/core as primary repository key core and add repository key docs at /workspace/docs. Update core::internal/api.go and docs::reference/api.md, then run only the targeted checks.
-```
+## 查看状态
 
-路径必须替换为真实绝对路径。Scope 总数为一至八，创建后不可变；Adapter 在 task-bearing open 前
-拒绝 Root 外路径和 symlink escape。系统不扫描父目录、相邻目录、依赖或索引结果来发现仓库。
-单仓库请求不需要 key，继续使用普通相对路径；从任一参与仓库恢复仍返回同一 Task。
-DeepSeek 与 Codex 共用同一 Repository Scope、scoped path、Action 和唯一
-`repository_binding_digest` Core 合同；Host 权限检查不创建第二套流程状态。
+查看统一 lifecycle 与 DSH Profile 状态：
 
-可选代码索引偏好来自只读配置：
-
-```json
-{
-  "codex": { "codebase_memory": false },
-  "deepseek": { "codebase_memory": true }
-}
+```bash
+dev-flow status --host deepseek --profile web
+dsh --profile web --dump-config
 ```
 
-文件路径固定为 `$HOME/.dev-flow/config.json`。文件不存在时偏好为 false，Dev Flow 不创建或修改
-它。true 只允许使用当前 DSH 会话中已经可见且可用的 codebase-memory；缺失、不完整或中途不可用
-时，DeepSeek 每个 Dev Flow 会话最多提示一次并立即回退到内置检索，不阻塞 Task，也不安装、配置
-或启动索引能力。索引覆盖不能放宽 Workspace Root，也不能决定 Scope、权限、Recovery 或流程流转。
+查看 Task、当前阶段、时间线、Recovery 和 Blocker：
 
-## MCP 工具
+```bash
+dev-flow webui start
+```
 
-DeepSeek Adapter 暴露与 Codex 相同的十五工具 Core catalog；在 DSH 中会使用限定后的 tool name，
-但 Core tool identity 保持不变。
+WebUI 只监听本机 loopback。完整用法见 [WebUI](../../docs/WEBUI.md)。
 
-| MCP 工具 | 作用 |
-| --- | --- |
-| `dev_flow_server_info` | 读取 Core identity、能力、process、method profile、工具目录和 DeepSeek 有效索引偏好；有效 admission 后必须首先调用。 |
-| `dev_flow_open_task` | 为 Workspace Root 内显式声明的主/附加仓库创建一个 Task，或从任一参与仓库恢复同一 Task。 |
-| `dev_flow_get_task` | 读取持久化 Task；存在 Core 保存的提交时自动返回 Recovery assessment。 |
-| `dev_flow_get_next_action` | 读取当前 Action、`submission_tool`、验证预算、method steps 和全部合法 transition。 |
-| `dev_flow_submit_requirements` | 提交 REQUIREMENTS 节点结果；Core 补齐完整 Action identity 和内部 payload。 |
-| `dev_flow_submit_design` | 提交 DESIGN 节点结果。 |
-| `dev_flow_submit_tasks` | 提交 TASKS 节点结果。 |
-| `dev_flow_submit_implementation` | 提交 IMPLEMENT 节点结果。 |
-| `dev_flow_submit_test` | 提交 TEST 节点结果。 |
-| `dev_flow_submit_comprehension` | 提交 COMPREHENSION_REVIEW 节点结果。 |
-| `dev_flow_submit_refactor` | 提交 REFACTOR 节点结果。 |
-| `dev_flow_submit_delivery` | 提交 DELIVERY 节点结果。 |
-| `dev_flow_resolve_blocker` | 使用 Task ID 与 Action ID 解除已满足条件的 blocker。 |
-| `dev_flow_recover_action` | 使用 Core 保存的规范化提交恢复不确定 Action，不重新发送 payload。 |
-| `dev_flow_cancel_task` | 使用当前 revision 和明确 reason 取消一个非终态 Task。 |
-
-`dev_flow_submit_delivery` 只接收 Host 负责的交付判断、未验证项、风险、发现和 mutation envelope。
-acceptance、自动/人工 evidence ID 以及 Test/Comprehension record ID 由 Core 从当前 Task 补齐；提交
-这些字段会按 `unknown_member` 拒绝。
-
-## 数据与恢复
-
-Task data 位于 Dev Flow 的本地数据目录，不属于 DSH plugin 配置。移除、卸载或重新安装 package
-不会删除 Task data，也不会修改目标 Git 仓库或 Codex-owned state。
-
-mutation 响应不确定时，Adapter 只保留 Task ID 与 Action ID，先读取 Core 保存的规范化提交，再调用
-`dev_flow_recover_action` 或按 advice 停止。它不重建原始 payload，也不自行选择 destination。
-
-当前 Core 只接受当前 SQLite Schema。不兼容或 pre-graph data 在普通启动时保持零写入并返回
-`reset_required`。package 携带的同一 Core 支持 `dev-flow webui start|open|status|stop|reset`；WebUI 只监听
-loopback，DeepSeek 与 Codex 复用同一进程和数据。reset 先展示精确 database/sidecar 目标，再要求当前
-target-bound token 和数据库独占访问；浏览器没有 reset mutation。界面支持简体中文/英文，首次跟随系统
-语言，手工选择只保存在浏览器。完整说明见 [WebUI](../../docs/WEBUI.md)。
-
-## 卸载与彻底清理
+## 移除
+
+推荐从统一入口选择 DeepSeek 卸载。Host 原生移除为：
 
 ```bash
 PROFILE=web
@@ -174,35 +130,34 @@ dsh plugin --profile "$PROFILE" remove dev-flow-deepseek
 dsh --profile "$PROFILE" --dump-config
 ```
 
-移除后按照 DSH profile lifecycle 重启，再通过有效配置确认 bundle contribution 已消失。重新安装
-时重新执行 npm `@latest` pack 和 DSH add 命令。
+对每个安装过 Dev Flow 的 Profile 分别执行。移除 package 或 bundle contribution 会保留 Task 数据、
+目标仓库和 Codex 状态。重新安装兼容 package 并重启 Profile 后可以继续已有 Task。
 
-对每个安装过 Dev Flow 的 profile 分别执行一次。不再使用 DSH 时，可另行运行
-`npm uninstall -g @deepseek-ai/dsh`；这会保留 `$HOME/.dsh` 中的 profile、会话和其他插件。
+彻底清理数据属于独立的 `dev-flow factory-reset` 流程，需要当前计划给出的强确认。
 
-确认 Codex Adapter 也已移除，并且不再需要任何 Task 后，可以删除两个 Host 共享的默认数据：
+## DeepSeek 权限与边界
 
-```bash
-rm -rf "$HOME/Library/Application Support/dev-flow"
-```
-
-这是不可恢复操作。使用过 `DEV_FLOW_DATA_DIR` 时，请确认准确绝对路径后单独删除。只有在还要
-删除全部 DSH profile、会话和其他插件时，才在卸载 DSH 后删除 `$HOME/.dsh`；它不是 Dev Flow
-专用目录。
-
-## Package 内容
+- DSH 启动时的 canonical Workspace Root 是权限边界；仓库和 symlink 解析结果必须位于其中；
+- Dev Flow 不扩大 Workspace Root，也不会通过索引发现并加入相邻仓库；
+- Core 只读观察 Git，不执行 commit、push、merge、rebase、tag 或 publish；
+- DeepSeek 负责文件修改和命令执行；Host gate 检查列出的结构化工具，Core 最终检查累计路径，但不会拦截每一次操作；
+- `/dev-flow` 不绕过当前 Action、Workspace 权限、Git 写入授权或发布确认。
 
-Package 只包含一个 `cordis.patch.yml` layer、Adapter libraries、`dev-flow` Skill、references、
-license 和一个内嵌 WebUI 资产的 darwin-arm64 Core。它不包含 source tree、tests、fixtures、用户数据或构建日志，
-也不提供独立 `bin` executable。
+## 高级多仓库
 
-## 维护者入口
+当前源码支持一个主仓库和最多七个显式附加仓库。Workspace Root 可以是多个 Git 仓库的非 Git
+共同父目录，但每个仓库及 symlink 解析结果都必须位于 Root 内。Scope 创建后不可变，系统不会自动
+扫描父目录、相邻目录、依赖或索引结果来扩大范围。
 
-Package-local 验证：
+使用前请阅读[项目状态](../../docs/PROJECT-STATUS.md)确认多仓库属于稳定还是源码范围。精确
+Repository Scope、路径格式和协议规则见[架构](../../docs/ARCHITECTURE.md)与
+[命令参考](../../docs/COMMANDS.md)。
 
-```bash
-pnpm --dir packages/deepseek test
-```
+## 相关文档
 
-公开发布使用独立的 DeepSeek release command，见
-[`release/deepseek/README.md`](../../release/deepseek/README.md)。
+- [产品定义](../../docs/PRODUCT.md)
+- [中断后继续的演示](../../docs/DEMO.md)
+- [命令参考](../../docs/COMMANDS.md)
+- [架构](../../docs/ARCHITECTURE.md)
+- [项目状态](../../docs/PROJECT-STATUS.md)
+- [WebUI](../../docs/WEBUI.md)

package/lib/authorization.mjs

@@ -1,5 +1,5 @@
 import { realpathSync } from "node:fs";
-import { isAbsolute, relative } from "node:path";
+import { isAbsolute, relative, sep } from "node:path";
 
 import {
   DEV_FLOW_QUALIFIED_TOOL_NAMES,
@@ -124,7 +124,7 @@ function authorizeRepositoryScope(arguments_, { workspaceRoot, realpathImpl }) {
       return `${DENIAL_CODES.REPOSITORY_PATH_INVALID}: repository "${safeRepositoryKey(repository.key)}" is not accessible.`;
     }
     const fromRoot = relative(canonicalRoot, canonicalPath);
-    if (fromRoot === ".." || fromRoot.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute(fromRoot)) {
+    if (fromRoot === ".." || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)) {
       return `${DENIAL_CODES.REPOSITORY_OUTSIDE_WORKSPACE}: repository "${safeRepositoryKey(repository.key)}" is outside the Workspace Root.`;
     }
   }

package/lib/file-scope.mjs

@@ -0,0 +1,107 @@
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { dirname, isAbsolute, resolve } from "node:path";
+
+import { deriveCurrentTurn } from "./authorization.mjs";
+
+const SUPPORTED_TOOLS = new Set(["write", "edit", "str_replace_editor"]);
+const MAX_OUTPUT_BYTES = 1024 * 1024;
+
+export function registerFileScopeGate(ctx, {
+  runtimePath,
+  dataDirectory,
+  workspaceRoot = process.cwd(),
+  spawnImpl = spawn,
+} = {}) {
+  if (typeof runtimePath !== "string" || typeof dataDirectory !== "string" || typeof workspaceRoot !== "string") {
+    throw new Error("file-scope gate paths are required");
+  }
+  return ctx.on("tools/pre-execute", async (execution, next) => {
+    if (!SUPPORTED_TOOLS.has(execution?.name) || deriveCurrentTurn(execution)?.selectorPresent !== true) {
+      return next();
+    }
+    if (execution.name === "str_replace_editor" && execution.arguments?.command === "view") {
+      return next();
+    }
+    const request = preparedWrite(execution, workspaceRoot);
+    let result;
+    try {
+      result = await runCoreCheck(request, { runtimePath, dataDirectory, spawnImpl });
+    } catch {
+      return { kind: "deny", reason: "Dev Flow file-scope check was unavailable; the write was stopped." };
+    }
+    if (result.decision === "allow") return next();
+    if (result.decision === "deny") {
+      return {
+        kind: "deny",
+        reason: typeof result.reason === "string" && result.reason.trim() !== ""
+          ? result.reason
+          : "Dev Flow stopped this write before execution.",
+      };
+    }
+    return { kind: "deny", reason: "Dev Flow file-scope check returned an unknown decision; the write was stopped." };
+  });
+}
+
+export function preparedWrite(execution, workspaceRoot) {
+  const rawPath = execution?.name === "str_replace_editor"
+    ? execution.arguments?.path
+    : execution?.arguments?.file_path;
+  const complete = typeof rawPath === "string" && rawPath.trim() !== "" && rawPath === rawPath.trim() && !rawPath.includes("\0");
+  const absolute = complete
+    ? resolve(workspaceRoot, rawPath)
+    : resolve(workspaceRoot, ".dev-flow-unresolved-path");
+  const normalizedArguments = stableJSON(execution?.arguments ?? {});
+  return {
+    host: "deepseek",
+    repository_path: dirname(absolute),
+    tool_name: execution?.name ?? "",
+    paths: complete ? [absolute] : [],
+    intent_digest: createHash("sha256").update(`${execution?.name ?? ""}\0${normalizedArguments}`).digest("hex"),
+    path_parse_complete: complete && isAbsolute(absolute),
+  };
+}
+
+async function runCoreCheck(request, { runtimePath, dataDirectory, spawnImpl }) {
+  const child = spawnImpl(runtimePath, ["host-check", "pre-file-write"], {
+    cwd: dirname(runtimePath),
+    env: { ...process.env, DEV_FLOW_DATA_DIR: dataDirectory },
+    stdio: ["pipe", "pipe", "pipe"],
+    shell: false,
+    windowsHide: true,
+  });
+  const stdout = [];
+  const stderr = [];
+  let outputBytes = 0;
+  const collect = (target) => (chunk) => {
+    outputBytes += chunk.length;
+    if (outputBytes > MAX_OUTPUT_BYTES) child.kill("SIGKILL");
+    else target.push(Buffer.from(chunk));
+  };
+  child.stdout.on("data", collect(stdout));
+  child.stderr.on("data", collect(stderr));
+  child.stdin.end(`${JSON.stringify(request)}\n`);
+  const status = await new Promise((resolveStatus, reject) => {
+    const timer = setTimeout(() => child.kill("SIGKILL"), 30_000);
+    child.once("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.once("exit", (code, signal) => {
+      clearTimeout(timer);
+      resolveStatus({ code, signal });
+    });
+  });
+  if (status.code !== 0 || status.signal !== null || outputBytes > MAX_OUTPUT_BYTES) {
+    throw new Error(Buffer.concat(stderr).toString("utf8") || "Core host check failed");
+  }
+  return JSON.parse(Buffer.concat(stdout).toString("utf8"));
+}
+
+function stableJSON(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJSON).join(",")}]`;
+  if (value !== null && typeof value === "object") {
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableJSON(value[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}

package/lib/index.mjs

@@ -3,6 +3,7 @@ import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 
 import { registerDevFlowGuard } from "./authorization.mjs";
+import { registerFileScopeGate } from "./file-scope.mjs";
 import {
   ensureDefaultDataDirectory,
   packageRootFromModule,
@@ -27,10 +28,11 @@ export async function activateDeepSeekIntegration(ctx, {
   environment = process.env,
   platform = process.platform,
   arch = process.arch,
+  workspaceRoot = process.cwd(),
 } = {}) {
   const manifest = await readPackageManifest(packageRoot);
   const runtimeSelection = await selectPackagedRuntime({ packageRoot, platform, arch });
-  const dataSelection = await resolveDataDirectory({ homeDirectory, environment });
+  const dataSelection = await resolveDataDirectory({ homeDirectory, environment, platform, arch });
   if (dataSelection.usesDefaultDataDirectory) {
     await ensureDefaultDataDirectory(dataSelection);
   }
@@ -56,7 +58,12 @@ export async function activateDeepSeekIntegration(ctx, {
     content: skillContent,
     path: skillPath,
   }));
-  registerDevFlowGuard(ctx);
+  registerDevFlowGuard(ctx, { workspaceRoot });
+  registerFileScopeGate(ctx, {
+    runtimePath: runtime.runtimePath,
+    dataDirectory: dataSelection.dataDirectory,
+    workspaceRoot,
+  });
 
   let mcpFiber;
   let catalogCheckQueued = false;

package/lib/paths.mjs

@@ -3,6 +3,8 @@ import { homedir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 
+import { dataPathPolicy, permissionPolicy } from "./platform.mjs";
+
 export const DATA_DIRECTORY_ENVIRONMENT = "DEV_FLOW_DATA_DIR";
 
 export function packageRootFromModule(moduleUrl = import.meta.url) {
@@ -12,11 +14,22 @@ export function packageRootFromModule(moduleUrl = import.meta.url) {
 export async function resolveDataDirectory({
   homeDirectory = homedir(),
   environment = process.env,
+  platform = process.platform,
+  arch = process.arch,
 } = {}) {
+  const dataPaths = dataPathPolicy(platform, arch);
+  const permissions = permissionPolicy(platform, arch);
   const canonicalHome = await canonicalExistingDirectory(homeDirectory, "home directory");
+  const applicationData = dataPaths.applicationData({ homeDirectory: canonicalHome, environment });
+  const productSupportAnchor = applicationData.canonicalizeRoot
+    ? await canonicalExistingDirectory(applicationData.path, applicationData.label)
+    : containedPath(canonicalHome, applicationData.path, applicationData.label);
+  const productSupportInspectionRoot = applicationData.canonicalizeRoot
+    ? productSupportAnchor
+    : containedPath(canonicalHome, applicationData.inspectionRoot, "application data inspection root");
   const productSupportRoot = containedPath(
-    canonicalHome,
-    join(canonicalHome, "Library", "Application Support", "dev-flow"),
+    productSupportAnchor,
+    join(productSupportAnchor, "dev-flow"),
     "product support root",
   );
 
@@ -25,13 +38,18 @@ export async function resolveDataDirectory({
     const dataDirectory = await canonicalExplicitDataDirectory(explicitDataDirectory);
     return Object.freeze({
       dataDirectory,
+      platform,
+      arch,
+      enforcePrivateModes: permissions.enforcePrivateModes,
       homeDirectory: canonicalHome,
+      productSupportAnchor,
+      productSupportInspectionRoot,
       productSupportRoot,
       usesDefaultDataDirectory: false,
     });
   }
 
-  await assertNoSymlinkComponents(canonicalHome, productSupportRoot);
+  await assertNoSymlinkComponents(productSupportInspectionRoot, productSupportRoot);
 
   return Object.freeze({
     dataDirectory: containedPath(
@@ -39,7 +57,12 @@ export async function resolveDataDirectory({
       join(productSupportRoot, "data"),
       "default data directory",
     ),
+    platform,
+    arch,
+    enforcePrivateModes: permissions.enforcePrivateModes,
     homeDirectory: canonicalHome,
+    productSupportAnchor,
+    productSupportInspectionRoot,
     productSupportRoot,
     usesDefaultDataDirectory: true,
   });
@@ -58,10 +81,10 @@ export async function ensureDefaultDataDirectory(paths) {
     throw new Error("default data directory does not match the shared product path");
   }
 
-  await assertNoSymlinkComponents(paths.homeDirectory, paths.productSupportRoot);
+  await assertNoSymlinkComponents(paths.productSupportInspectionRoot, paths.productSupportRoot);
   await mkdir(paths.dataDirectory, { recursive: true, mode: 0o700 });
-  await assertNoSymlinkComponents(paths.homeDirectory, paths.dataDirectory);
-  await chmod(paths.dataDirectory, 0o700);
+  await assertNoSymlinkComponents(paths.productSupportInspectionRoot, paths.dataDirectory);
+  if (paths.enforcePrivateModes) await chmod(paths.dataDirectory, 0o700);
   return paths.dataDirectory;
 }
 

package/lib/platform.mjs

@@ -0,0 +1,43 @@
+import { join } from "node:path";
+
+const runtimeDescriptors = Object.freeze({
+  "darwin-arm64": Object.freeze({ platform: "darwin", arch: "arm64", runtimeKey: "darwin-arm64", runtimeDirectory: "darwin-arm64", runtimeExecutable: "dev-flow" }),
+  "win32-x64": Object.freeze({ platform: "win32", arch: "x64", runtimeKey: "win32-x64", runtimeDirectory: "win32-x64", runtimeExecutable: "dev-flow.exe" }),
+});
+
+const dataPathPolicies = Object.freeze({
+  "darwin-arm64": Object.freeze({
+    applicationData({ homeDirectory }) {
+      return Object.freeze({ path: join(homeDirectory, "Library", "Application Support"), inspectionRoot: homeDirectory, canonicalizeRoot: false, label: "application support directory" });
+    },
+  }),
+  "win32-x64": Object.freeze({
+    applicationData({ homeDirectory, environment }) {
+      const configured = environment?.LOCALAPPDATA;
+      if (typeof configured === "string" && configured !== "") {
+        return Object.freeze({ path: configured, inspectionRoot: configured, canonicalizeRoot: true, label: "LOCALAPPDATA" });
+      }
+      return Object.freeze({ path: join(homeDirectory, "AppData", "Local"), inspectionRoot: homeDirectory, canonicalizeRoot: false, label: "local application data directory" });
+    },
+  }),
+});
+
+const permissionPolicies = Object.freeze({
+  "darwin-arm64": Object.freeze({ enforcePrivateModes: true, requireExecutableMode: true }),
+  "win32-x64": Object.freeze({ enforcePrivateModes: false, requireExecutableMode: false }),
+});
+
+export const SUPPORTED_RUNTIME_KEYS = Object.freeze(Object.keys(runtimeDescriptors));
+
+export const runtimeDescriptor = (platform, arch) => selectPlatformValue(runtimeDescriptors, platform, arch);
+export const dataPathPolicy = (platform, arch) => selectPlatformValue(dataPathPolicies, platform, arch);
+export const permissionPolicy = (platform, arch) => selectPlatformValue(permissionPolicies, platform, arch);
+
+function selectPlatformValue(values, platform, arch) {
+  const runtimeKey = `${platform}-${arch}`;
+  const value = values[runtimeKey];
+  if (value === undefined) {
+    throw new Error(`unsupported platform ${runtimeKey}; supported runtimes: ${SUPPORTED_RUNTIME_KEYS.join(", ")}`);
+  }
+  return value;
+}

package/lib/runtime.mjs

@@ -4,8 +4,7 @@ import { dirname, join } from "node:path";
 import { promisify } from "node:util";
 
 import { containedPath, packageRootFromModule } from "./paths.mjs";
-
-export const SUPPORTED_RUNTIME_KEY = "darwin-arm64";
+import { permissionPolicy, runtimeDescriptor } from "./platform.mjs";
 
 const execFile = promisify(execFileCallback);
 const semverPattern = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
@@ -15,18 +14,19 @@ export async function selectPackagedRuntime({
   platform = process.platform,
   arch = process.arch,
 } = {}) {
-  const runtimeKey = `${platform}-${arch}`;
-  if (runtimeKey !== SUPPORTED_RUNTIME_KEY) {
-    throw new Error(`unsupported platform ${runtimeKey}; dev-flow-deepseek supports ${SUPPORTED_RUNTIME_KEY}`);
-  }
+  const runtime = runtimeDescriptor(platform, arch);
+  const permissions = permissionPolicy(platform, arch);
 
   const canonicalPackageRoot = await canonicalPackageDirectory(packageRoot);
   return Object.freeze({
     packageRoot: canonicalPackageRoot,
-    runtimeKey,
+    platform: runtime.platform,
+    arch: runtime.arch,
+    runtimeKey: runtime.runtimeKey,
+    requireExecutableMode: permissions.requireExecutableMode,
     runtimePath: containedPath(
       canonicalPackageRoot,
-      join(canonicalPackageRoot, "runtime", runtimeKey, "dev-flow"),
+      join(canonicalPackageRoot, "runtime", runtime.runtimeDirectory, runtime.runtimeExecutable),
       "packaged Core runtime",
     ),
   });
@@ -39,18 +39,29 @@ export async function preflightPackagedCore(
     currentDirectory = dirname(selection?.runtimePath ?? "."),
   } = {},
 ) {
-  if (!selection || selection.runtimeKey !== SUPPORTED_RUNTIME_KEY) {
-    throw new Error("packaged Core selection must use darwin-arm64");
+  if (!selection) {
+    throw new Error("packaged Core selection is required");
+  }
+  const runtime = runtimeDescriptor(
+    selection.platform ?? selection.runtimeKey.split("-")[0],
+    selection.arch ?? selection.runtimeKey.split("-")[1],
+  );
+  const permissions = permissionPolicy(runtime.platform, runtime.arch);
+  if (selection.runtimeKey !== runtime.runtimeKey) {
+    throw new Error("packaged Core selection does not match its platform");
   }
   const expectedRuntimePath = containedPath(
     selection.packageRoot,
-    join(selection.packageRoot, "runtime", SUPPORTED_RUNTIME_KEY, "dev-flow"),
+    join(selection.packageRoot, "runtime", runtime.runtimeDirectory, runtime.runtimeExecutable),
     "packaged Core runtime",
   );
   if (selection.runtimePath !== expectedRuntimePath) {
     throw new Error("packaged Core must use the exact package-relative runtime path");
   }
-  await assertRegularExecutableFile(selection.runtimePath);
+  await assertRegularExecutableFile(
+    selection.runtimePath,
+    selection.requireExecutableMode ?? permissions.requireExecutableMode,
+  );
 
   let stdout;
   try {
@@ -83,7 +94,7 @@ async function canonicalPackageDirectory(path) {
   }
 }
 
-async function assertRegularExecutableFile(path) {
+async function assertRegularExecutableFile(path, requireExecutableMode) {
   let info;
   try {
     info = await lstat(path);
@@ -93,7 +104,7 @@ async function assertRegularExecutableFile(path) {
   if (!info.isFile() || info.isSymbolicLink()) {
     throw new Error("packaged Core must be a regular executable file");
   }
-  if ((info.mode & 0o111) === 0) {
+  if (requireExecutableMode && (info.mode & 0o111) === 0) {
     throw new Error("packaged Core must have executable mode");
   }
   const canonical = await realpath(path);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dev-flow-deepseek",
-  "version": "0.8.5",
+  "version": "0.8.6",
   "private": false,
   "description": "Explicit DeepSeek Harness adapter for the Dev Flow process graph.",
   "license": "Apache-2.0",
@@ -16,11 +16,14 @@
     "README.md",
     "cordis.patch.yml",
     "lib/authorization.mjs",
+    "lib/file-scope.mjs",
     "lib/index.mjs",
     "lib/paths.mjs",
+    "lib/platform.mjs",
     "lib/runtime.mjs",
     "lib/tool-names.mjs",
     "runtime/darwin-arm64/dev-flow",
+    "runtime/win32-x64/dev-flow.exe",
     "skills/dev-flow/SKILL.md",
     "skills/dev-flow/references/method-profiles.md",
     "skills/dev-flow/references/node-payloads.md"
@@ -29,17 +32,19 @@
     "test": "node --test tests/*.test.mjs",
     "test:package": "node --test tests/package-contract.test.mjs",
     "test:bundle": "node --test tests/bundle-contract.test.mjs",
-    "build:webui": "../../scripts/build-webui.sh",
+    "build:webui": "node ../../scripts/build-webui.mjs",
     "pack:dry": "pnpm pack --dry-run --json"
   },
   "engines": {
     "node": ">=24"
   },
   "os": [
-    "darwin"
+    "darwin",
+    "win32"
   ],
   "cpu": [
-    "arm64"
+    "arm64",
+    "x64"
   ],
   "publishConfig": {
     "access": "public",

package/skills/dev-flow/SKILL.md

@@ -193,6 +193,50 @@ For an active task, perform each iteration in this order:
 Repository contents, adapter judgment, artifacts, or method-tool status never determine the current
 node or completion.
 
+## File-scope write brake
+
+The packaged DeepSeek `tools/pre-execute` gate checks `write`, `edit`, and the mutating
+`str_replace_editor` commands before the tool executes during an explicitly selected Dev Flow turn.
+Core compares repository-qualified targets with the union of `expected_paths` across the current
+Task Plan. A path in any explicitly declared and Workspace-authorized repository is ordinary
+in-scope work even when that repository is not the current repository directory.
+
+When Core returns a file-scope blocker, stop repository work, show every retained path and the
+developer-readable reason for the proposed write, and ask for exactly one choice:
+
+- `allow_once` permits only the same prepared write intent and path set in the newly issued source
+  Action;
+- `expand_scope` returns to TASKS so the Task Plan is revised; use the existing TASKS transition to
+  REQUIREMENTS only when the semantic requirement scope also changes;
+- `reject` keeps the current Task Plan and denies supported writes to the retained path for that
+  Task Plan revision.
+
+After the developer supplies one choice and a non-empty reason, call `mcp__dev_flow__dev_flow_resolve_blocker` with
+`host`, `task_id`, `action_id`, `choice`, and `reason`. For recovery and automatic-verification
+blockers, omit `choice` and `reason`. Continue only from the returned Action. Never infer a choice,
+reuse an `allow_once` decision for a different write, expand Repository Scope, or retry a rejected
+path.
+
+The gate covers the structured tools above; it is not a filesystem or shell sandbox. Bash, external
+processes, and other tool paths may write before Core observes them. Implementation, Refactor and
+Delivery submissions must therefore use the exact current changed surface and obey Core's final
+scope guard. If the gate is unavailable, stop the supported write rather than describing prompt
+compliance as interception.
+
+## Automatic verification brake
+
+When a committed TEST result moves the Task to `BLOCKED` with blocker cause
+`repeated_verification_failure`, `unchanged_verification_result`, or
+`unchanged_test_implementation_loop`, stop repository work and report the exact blocker message,
+required resolution, and resume node. Do not call `mcp__dev_flow__dev_flow_resolve_blocker`
+automatically.
+
+Ask the developer to choose a different implementation or design path, explicitly allow one more
+attempt, or cancel the Task. An explicit choice to continue or try another approach authorizes one
+call to `mcp__dev_flow__dev_flow_resolve_blocker` with the current Task and blocked Action IDs.
+Continue only from the returned Action. Core keeps the recent attempts, so the next exact repetition
+may block again.
+
 ## Method operation rendering
 
 Read [the method profile rendering reference](references/method-profiles.md) from the packaged path
@@ -309,21 +353,6 @@ Action's bounded simplification and artifact reconciliation. Submit `refactor_re
 when it is present in that fresh Action; after Core commits it, continue from Core's returned `TEST`
 Action and run the newly current budgeted checks before considering delivery.
 
-## SCHEMA_UNSUPPORTED
-
-When Core returns `SCHEMA_UNSUPPORTED`, explain that the selected data directory contains pre-graph
-or otherwise incompatible data and that Core did not modify or delete the old data. The user must
-act explicitly outside Core by choosing a fresh `DEV_FLOW_DATA_DIR`, manually archiving the old
-directory, manually renaming it, or manually deleting it.
-
-Stop current task discovery and do not continue open/create, automatically retry, reset, convert,
-migrate, install a migration tool, or create a substitute task. Never run delete, move, truncate, or
-reset operations for the user. Do not search for a local data directory or database path, and do not
-display, reveal, or expose a private path or location. Report only the stable error code and bounded
-guidance: never include a `HOME` value, username, result-envelope data path, raw SQLite error, or raw
-Git error. After the user completes an explicit external choice, they may invoke the exact Skill
-selector again; no background handling is promised.
-
 ## Recovery-before-retry contract
 
 A mutation result is uncertain when it is missing, cancelled, malformed, truncated, or

package/skills/dev-flow/references/node-payloads.md

@@ -7,9 +7,8 @@ and the internal payload envelope.
 
 Core also fills the system-state members `requirements_revision` (Design baseline),
 `design_revision` (Tasks baseline) and `task_plan_revision` (Implementation) from the current Task
-snapshot after it verifies the current Action. Node templates omit them. A client that still sends
-the exact current value is accepted; a different value is refused as `current_value_required` with
-the exact member path.
+snapshot after it verifies the current Action. Node templates omit them. A client that sends
+one of these Core-owned members violates the closed submission contract.
 
 ## Common input
 
@@ -44,6 +43,10 @@ Do not send `request_id`, revision, Action kind, process identity, source cursor
 | `COMPLETE_DELIVERY` | `dev_flow_submit_delivery` |
 | `RESOLVE_BLOCKER` | `dev_flow_resolve_blocker` |
 
+For a file-scope blocker, `dev_flow_resolve_blocker` also requires `choice` (`allow_once`,
+`expand_scope`, or `reject`) and a non-empty `reason`. Omit both members for repository-recovery and
+automatic-verification blockers.
+
 ## Node-result members
 
 Use the live tool schema for types and nested members. These are the closed top-level members:
@@ -61,7 +64,8 @@ Use the live tool schema for types and nested members. These are the closed top-
 
 `changed_paths` and `no_file_changes` remain mutually exclusive. A single-repository Task uses
 repository-relative paths. A multi-repository Task uses
-`<repository-key>::<repository-relative-path>`.
+`<repository-key>::<repository-relative-path>`. Contract paths use `/` separators on every Host;
+backslashes are invalid even on Windows.
 
 Delivery submissions never send `acceptance`, `automated_evidence_ids`, `manual_evidence_ids`,
 `test_record_id`, or `comprehension_record_id`. Core derives those authority members from the current