dsh-compound-engineering 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Every
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,161 @@
-# Temporary Holding Version
+# dsh-compound-engineering
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+English | [简体中文](README.zh.md)
+
+[Every's compound-engineering](https://github.com/EveryInc/compound-engineering-plugin) methodology, packaged as a skill bundle for DeepSeek Harness.
+
+**The idea**: most AI coding tools restart from zero on every task. compound-engineering compounds instead — every problem you solve gets written down in the repo, so the next time something similar comes up, the answer is already there. Each change makes the next one cheaper.
+
+```
+brainstorm → plan → work → review → compound
+                                      └─ write what you learned back into the repo
+```
+
+All 36 skills ship with the package. Nothing to configure after install.
+
+**Optional: `jq`.** Six scripts shell out to it — the cross-model workers (`ce-work`, `ce-code-review`, `ce-doc-review`, `ce-pov`) and `elevation-dispatch` (`ce-plan`, `ce-brainstorm`). Without `jq` on `PATH` none of them break the surrounding skill, but they degrade in two different ways:
+
+- `ce-code-review` / `ce-doc-review` / `ce-pov` print `jq not installed; skipping` and exit 0 — that round of cross-model review is simply skipped.
+- `ce-work`'s cross-model path reports `transport unavailable (pre-egress, shared): jq not found` and exits 2, which the caller treats as the cross-model channel being unavailable.
+- `elevation-dispatch` emits a `status:failed` envelope, and the caller degrades to inline execution.
+
+Either way you lose the multi-model cross-check. Install it if you want those paths live:
+
+```bash
+winget install jqlang.jq    # Windows
+brew install jq             # macOS
+apt install jq              # Debian/Ubuntu
+```
+
+## Install
+
+```bash
+dsh plugin --profile web add dsh-compound-engineering
+```
+
+Replace `web` with the profile you actually use (`headless`, `tui`, ...). The command also adds the package to `dsh.profile.bundles` for you.
+
+Or do it by hand: add the dependency to the profile's `package.json`, then list it in `dsh.profile.bundles`.
+
+```jsonc
+{
+  "dependencies": { "dsh-compound-engineering": "^0.1.0" },
+  "dsh": { "profile": { "bundles": ["dsh-compound-engineering"] } }
+}
+```
+
+Restart DSH. Type `/ce-plan` in a session and the skills are there.
+
+## Skills you will actually reach for
+
+| Skill | When |
+| --- | --- |
+| `/ce-brainstorm` | The idea is still vague; force it into a concrete proposal |
+| `/ce-plan` | Requirements are clear; you want an executable plan |
+| `/ce-work` | Execute the plan |
+| `/ce-code-review` | Find problems before review does (can fan out across models) |
+| `/ce-compound` | **Wrap up**: write the non-obvious conclusions into the repo |
+| `/ce-debug` | Stuck; locate the root cause systematically |
+| `/ce-commit-push-pr` | Commit, push, and open a PR in one go |
+
+`/lfg` chains brainstorm through PR.
+
+The other 28 skills live in `skills/`, or just ask the model what it can see.
+
+## ce-compound is the part that differs
+
+Most "memory" plugins remember conversations. `ce-compound` remembers the **repo**:
+
+- It reads your local dsh session history first to recover what was already tried and why it failed
+- Output goes into `<repo>/docs/solutions/`, committed and reviewed alongside code
+- The next person — or the next model — working in that repo reads it
+
+It deliberately does not record which lines changed; git already has that. It records why, which neither the code nor the tests can tell you.
+
+## Adapting to DeepSeek Harness
+
+Upstream targets 14 hosts including Claude Code. The port does this:
+
+**Capabilities are matched by capability, not by tool name.** Upstream was already written that way ("the host's blocking question tool"), so the 36 skill bodies work nearly as-is. What got added is the DSH spelling: `ask_user_question`, `todo_write`, `subagent`, `web_fetch`, `web_search`.
+
+**Session history gained a dsh platform.** `skills/ce-compound/scripts/session-history/dsh_session.py` reads DSH's own session files. One trap worth knowing: DSH's `session.v4.jsonl.zstd` is **concatenated zstd frames**, one per append. Plain `zstd -d` or `compression.zstd.decompress` stops after the first frame and silently loses the rest of the session, so the script scans frame boundaries itself and decompresses frame by frame. It needs Python 3.14+; on older interpreters it degrades quietly to "no dsh sessions".
+
+**The session-history extractors are dsh-only.** `extract-metadata.py`, `extract-skeleton.py`, and `extract-errors.py` decode dsh session files and nothing else, which dropped ~845 lines of Claude Code / Codex / Cursor / Pi / oh-my-pi branching. `discover-sessions.sh` keeps its other probes so a mixed-tool repo can still enumerate files, but run the documented pipeline with `--platform dsh`. Sessions carry a recorded `cwd` but no git branch, so filtering is by working directory, not by branch.
+
+**Dev-server config prefers `.dsh/launch.json`.** `ce-polish` looks in `.dsh/` → `.claude/` → `.vscode/`.
+
+**Host identity allowlists accept `dsh`.** Several cross-model scripts only knew `codex|claude|grok|cursor|opencode|antigravity|omp`, so reporting `dsh` honestly was rejected.
+
+**Task tracking, subagents, and web fetching** each gained a DSH form. Subagents use `subagent` directly rather than faking a `subagent_type`.
+
+**Windows works for the `ce-work` unit pipeline.** That path was POSIX-only upstream. Four things had to change, and any of them will bite you if you port similar code:
+
+- `fcntl` does not exist. Locking goes through `msvcrt.locking`, which is non-blocking and raises instead of waiting, so the wrapper retries with exponential backoff for up to 30s.
+- `os.open()` **cannot open a directory** on Windows — the kernel rejects it without `FILE_FLAG_BACKUP_SEMANTICS`. Every `open(path, O_DIRECTORY)` + `fstat(fd)` ownership check became a path-based `GetNamedSecurityInfoW` call. `dir_fd` is unavailable for the same reason, so the "directory handle" is a real fd on POSIX and a plain path on Windows; `close_dir_handle()` papers over the difference.
+- Mode bits are synthetic: a `0o700` mkdir reports `0o777` and a `0o600` file reports `0o666`. Every `st_mode != 0o700` gate would fail unconditionally. Ownership is checked against the current user's SID instead, and privacy comes from the hardened ACL (`icacls /inheritance:r`), not from a mode.
+- `\n` turns into `\r\n` and `0x1A` ends the read when the CRT opens a descriptor in text mode, so binary opens pass `O_BINARY`.
+
+`os.lstat()` does return stable, non-zero `st_dev`/`st_ino` on Windows, so the controller's recorded directory identity still verifies.
+
+**Text is read as UTF-8 explicitly.** Python on a Chinese Windows defaults to GBK and throws `UnicodeDecodeError` on most of upstream's own skill files.
+
+## Development
+
+```bash
+npm test                          # JS unit + integration, then the Python suites
+npm run test:smoke                # three layers: provider / registry / plugin lifecycle
+npm run test:py                   # Python suites only (session reader, Windows compat)
+```
+
+Integration tests need to find a DSH runtime: they import by package name first, then scan `~/.dsh/runtime/versions/*`. Point `DSH_RUNTIME` at it to override.
+
+After pulling in upstream changes, re-run the two idempotent patch scripts:
+
+```bash
+python scripts/patch-dsh-capabilities.py   # add DSH forms to skill bodies
+python scripts/patch-host-allowlists.py    # add dsh to cross-model host allowlists
+```
+
+### With `file:` installs, refresh the copy after editing source
+
+`dsh plugin add file:<local path>` goes through pnpm directory dependencies, so `node_modules/` holds a **copy**, not a symlink. pnpm records the dependency's contents in its lockfile (`resolution: {directory: ..., type: directory}`), which means `pnpm install`, `pnpm update`, and even re-running `dsh plugin add` will **not** refresh that copy after you edit source. You keep running the old code, and since the skill catalog comes from the stale copy, changes under `lib/` look like they did nothing.
+
+Check whether you are hitting this (a hash mismatch means yes):
+
+```bash
+md5sum skills/ce-work/scripts/unit_workspace_state.py \
+  ~/.dsh/profiles/web/node_modules/dsh-compound-engineering/skills/ce-work/scripts/unit_workspace_state.py
+```
+
+Rebuilding the copy is the shortest fix:
+
+```bash
+python -c "
+import shutil, os
+dst = os.path.expanduser('~/.dsh/profiles/web/node_modules/dsh-compound-engineering')
+shutil.rmtree(dst, ignore_errors=True)
+shutil.copytree('<source dir>', dst,
+                ignore=shutil.ignore_patterns('node_modules','.git','__pycache__','*.pyc','test'))
+"
+```
+
+The copy's `skills/` must mirror the source one-to-one (`test/` is not shipped). Restart DSH after changing `lib/` so the plugin reloads.
+
+## Layout
+
+```
+lib/
+  index.js       plugin entry: registers a provider with ctx.skills
+  provider.js    exposes skills/ as a SkillProvider
+  frontmatter.js dependency-free YAML frontmatter parser
+skills/          36 skills, shipped as upstream wrote them
+cordis.patch.yml inserts the plugin into a profile's layer stack
+test/            unit + integration tests
+scripts/         upstream-sync patches, smoke tests
+```
+
+No runtime dependencies: skill frontmatter is read by the bundled parser, so this package never fights the host over YAML versions.
+
+## License
+
+MIT, same as upstream. The skills are Every's work (Copyright (c) 2025 Every); see `LICENSE`.

package/README.zh.md

@@ -0,0 +1,161 @@
+# dsh-compound-engineering
+
+[English](README.md) | 简体中文
+
+把 [Every 的 compound-engineering](https://github.com/EveryInc/compound-engineering-plugin) 方法论搬进 DeepSeek Harness 的技能包。
+
+**核心想法**：大多数 AI 编程工具让每次任务都从零开始。compound-engineering 改成复利——每次解决的问题都沉淀成仓库里的一份文档，下一次遇到同类问题时直接读到，于是每一轮改动都让下一轮更容易。
+
+```
+brainstorm → plan → work → review → compound
+                                      └─ 把这次学到的东西写进仓库
+```
+
+36 个技能全部随包分发，安装后无需任何配置即可使用。
+
+**可选依赖 `jq`。** 有六个脚本会调用它：cross-model 系列（`ce-work`、`ce-code-review`、`ce-doc-review`、`ce-pov`）以及 `elevation-dispatch`（`ce-plan`、`ce-brainstorm`）。没有 `jq` 时它们都不会中断所在技能，但降级方式分两种：
+
+- `ce-code-review` / `ce-doc-review` / `ce-pov`：打印 `jq not installed; skipping` 后退出码 0，该轮多模型审查直接跳过。
+- `ce-work` 的 cross-model：报 `transport unavailable (pre-egress, shared): jq not found` 并以退出码 2 结束，外层按“跨模型通道不可用”处理。
+- `elevation-dispatch`：输出 `status:failed` 的结果信封，外层降级为内联执行。
+
+你也就失去了多模型交叉复核这一层。想启用就装上：
+
+```bash
+winget install jqlang.jq    # Windows
+brew install jq             # macOS
+apt install jq              # Debian/Ubuntu
+```
+
+## 安装
+
+```bash
+dsh plugin --profile web add dsh-compound-engineering
+```
+
+`web` 换成你实际用的 profile 名（`headless`、`tui` 等）。这条命令会自动把这个包加进 `dsh.profile.bundles`，不用手工改配置。
+
+也可以手工两步：在 profile 的 `package.json` 里加依赖，再把它加进 `dsh.profile.bundles`。
+
+```jsonc
+{
+  "dependencies": { "dsh-compound-engineering": "^0.1.0" },
+  "dsh": { "profile": { "bundles": ["dsh-compound-engineering"] } }
+}
+```
+
+装好后重启 DSH。会话里敲 `/ce-plan` 就能看到技能。
+
+## 常用技能
+
+| 技能 | 什么时候用 |
+| --- | --- |
+| `/ce-brainstorm` | 想法还模糊，先把它逼成明确的方案 |
+| `/ce-plan` | 需求清楚，要一份能执行的计划 |
+| `/ce-work` | 按计划动手实现 |
+| `/ce-code-review` | 提交前找人挑刺（可以并行多模型对照） |
+| `/ce-compound` | **收尾**：把这次排查出的非显然结论写进仓库 |
+| `/ce-debug` | 卡住了，系统性定位根因 |
+| `/ce-commit-push-pr` | 一次走完提交、推送、开 PR |
+
+`/lfg`（let's f\*\*\*ing go）把 brainstorm 到 PR 的全流程串起来。
+
+其余 28 个技能见 `skills/` 目录，或直接问模型"有哪些技能"。
+
+## ce-compound 是这套东西的差异点
+
+别处的"记忆"插件记住的是对话。`ce-compound` 记住的是**仓库**：
+
+- 跑起来会先读本机的 dsh 历史会话文件，把当时踩过的坑挖出来
+- 产出写在 `<repo>/docs/solutions/` 下，随代码一起提交、一起 review
+- 下次任何人（或任何模型）在同一个仓库工作时都会读到它
+
+它刻意不记录"改了哪几行"——那从 git 里就能看出来。它记录的是"为什么这么改"这类从代码和测试里读不出来的东西。
+
+## 在 DeepSeek Harness 上的适配
+
+上游是给 Claude Code 等 14 个宿主写的。移植时做了这些事：
+
+**平台能力靠"能力"匹配，不硬编码工具名。** 上游正文本来就用 "the host's blocking question tool" 这类措辞，所以 36 个技能的正文几乎原样可用。补的只是 DSH 这一档的具体名字（`ask_user_question`、`todo_write`、`subagent`、`web_fetch`、`web_search`）。
+
+**会话历史多了 dsh 平台。** `skills/ce-compound/scripts/session-history/dsh_session.py` 能读 DSH 自己的会话文件。这里有个坑值得记：DSH 的 `session.v4.jsonl.zstd` 是**多个 zstd 帧首尾拼接**（每次 append 追加一帧），标准的 `zstd -d` 或 `compression.zstd.decompress` 只解第一帧就返回，会静默丢掉整个会话。所以脚本自己扫帧边界，逐帧解压。需要 Python 3.14+；更老的解释器上会安静降级成"没有 dsh 会话可读"。
+
+**会话历史三个提取脚本只认 dsh。** `extract-metadata.py`、`extract-skeleton.py`、`extract-errors.py` 只解 dsh 会话，原来的 Claude Code / Codex / Cursor / Pi / oh-my-pi 分支全部删掉，净减约 845 行。`discover-sessions.sh` 保留了其它平台探测（混合工具仓库仍能列文件），但文档里的管道固定带 `--platform dsh`。dsh 会话只记 `cwd` 不记 git 分支，所以过滤按工作目录走，不按分支。
+
+**dev server 配置优先读 `.dsh/launch.json`。** `ce-polish` 需要知道怎么起本地服务，查找顺序是 `.dsh/` → `.claude/` → `.vscode/`。
+
+**host 身份白名单加了 dsh。** 几个 cross-model 脚本原来只认 `codex|claude|grok|cursor|opencode|antigravity|omp`，如实上报 `dsh` 会被拒。
+
+**任务追踪、子代理、网页抓取**都补了 DSH 的对应物。子代理在 DSH 上直接 `subagent` 派生，不必造一个假的 `subagent_type`。
+
+**Windows 上 `ce-work` 的 unit 流水线现在能跑通。** 这条路线上游只做了 POSIX，改动了四处，移植同类代码时都会撞上：
+
+- `fcntl` 不存在。加锁改用 `msvcrt.locking`，但它是非阻塞的，抢不到锁直接抛异常而不等待，所以封装层做了指数退避重试，最长 30 秒。
+- Windows 上 **`os.open()` 打不开目录**（缺 `FILE_FLAG_BACKUP_SEMANTICS`，内核直接拒绝）。所有 `open(path, O_DIRECTORY)` + `fstat(fd)` 式的属主校验，改成走路径版的 `GetNamedSecurityInfoW`。`dir_fd` 同样不可用，于是"目录句柄"在 POSIX 上是真 fd、在 Windows 上是路径，由 `close_dir_handle()` 抹平差异。
+- mode 位是合成的：`mkdir` 0o700 实测报 0o777，`chmod` 0o600 实测报 0o666。任何 `st_mode != 0o700` 的闸门在 Windows 上必然失败。改为比对当前用户 SID，私密性靠加固过的 ACL（`icacls /inheritance:r`）而不是 mode。
+- CRT 文本模式会把 `\n` 变成 `\r\n`、在读到你 `0x1A` 时截断，所以二进制打开一律带 `O_BINARY`。
+
+`os.lstat()` 在 Windows 上能给出稳定的非零 `st_dev`/`st_ino`，所以控制器记录的目录 identity 仍然有效可校验。
+
+**文本一律显式按 UTF-8 读。** 中文 Windows 上 Python 默认 GBK，读上游自己的大部分技能文件都会抛 `UnicodeDecodeError`。
+
+## 开发
+
+```bash
+npm test              # JS 单元 + 集成测试，随后跑 Python 测试
+npm run test:smoke    # 三层冒烟：provider / registry / 插件生命周期
+npm run test:py       # 只跑 Python 测试（会话读取器、Windows 兼容）
+```
+
+集成测试需要能找到 DSH 运行时。默认从包名 import，失败则扫描 `~/.dsh/runtime/versions/*`；也可以用 `DSH_RUNTIME` 指过去。
+
+改上游技能后，重新跑这两个幂等补丁脚本：
+
+```bash
+python scripts/patch-dsh-capabilities.py   # 给技能正文补 DSH 档位
+python scripts/patch-host-allowlists.py    # 补 cross-model 的 host 白名单
+```
+
+### 用 `file:` 方式开发时，改完源码要刷副本
+
+`dsh plugin add file:<本地路径>` 走的是 pnpm 的目录依赖，`node_modules/` 里放的是**拷贝**，不是软链。pnpm 会把目录依赖的内容记进 lockfile（`resolution: {directory: ..., type: directory}`），所以改完源码之后跑 `pnpm install`、`pnpm update`、甚至重跑 `dsh plugin add` 都**不会**刷新那份拷贝——你会一直跑到旧代码，而且因为技能清单来自旧副本，`lib/` 里改了什么都看不出来。
+
+确认是否踩到（哈希不一致就是踩到了）：
+
+```bash
+md5sum skills/ce-work/scripts/unit_workspace_state.py \
+  ~/.dsh/profiles/web/node_modules/dsh-compound-engineering/skills/ce-work/scripts/unit_workspace_state.py
+```
+
+直接重建副本最省事：
+
+```bash
+python -c "
+import shutil, os
+dst = os.path.expanduser('~/.dsh/profiles/web/node_modules/dsh-compound-engineering')
+shutil.rmtree(dst, ignore_errors=True)
+shutil.copytree('<源码目录>', dst,
+                ignore=shutil.ignore_patterns('node_modules','.git','__pycache__','*.pyc','test'))
+"
+```
+
+副本里的 `skills/` 必须和源码一一对应（`test/` 不随包分发）。改完 `lib/` 后需要重启 DSH 才会重新加载插件。
+
+## 结构
+
+```
+lib/
+  index.js       插件入口：向 ctx.skills 注册 provider
+  provider.js    把 skills/ 目录暴露成 SkillProvider
+  frontmatter.js 零依赖 YAML frontmatter 解析
+skills/          36 个技能（上游原样分发）
+cordis.patch.yml 把插件插进 profile 的层栈
+test/            单元 + 集成测试
+scripts/         上游同步补丁、冒烟测试
+```
+
+本包不引入任何运行时依赖：技能的 YAML 用自带的解析器读，不与宿主的 YAML 版本打架。
+
+## 许可
+
+MIT，与上游一致。技能的著作权归 Every（Copyright (c) 2025 Every），见 `LICENSE`。

package/cordis.patch.yml

@@ -0,0 +1,6 @@
+# dsh-compound-engineering bundle patch: inserts its plugin row into a profile's
+# layer stack. The single row mounts the skill provider; the 36 skills ship
+# inside this package and need no user configuration.
+- insert:
+    - id: compound-engineering
+      name: 'dsh-compound-engineering'

package/lib/frontmatter.js

@@ -0,0 +1,167 @@
+/**
+ * 零依赖的 YAML frontmatter 解析器。
+ *
+ * 只覆盖 SKILL.md 实际使用的子集：顶层 `key: value` 标量、带引号字符串、
+ * 布尔字面量、以及 `key:` 后跟缩进列表（`- item`）。
+ *
+ * 之所以不引入 js-yaml：本插件是纯技能包，除了自身以外不向 profile 注入任何
+ * 运行时依赖，避免与宿主的 YAML 版本产生冲突。
+ */
+
+/** 单个值里允许出现的行内注释起始符（` #` 之后整段视为注释）。 */
+const INLINE_COMMENT = /\s+#.*$/;
+
+/**
+ * 去掉值两端的引号并还原转义。
+ * @param {string} raw 原始值文本
+ * @returns {string} 处理后的字符串
+ */
+function unquote(raw) {
+  const text = raw.trim();
+  if (text.length >= 2) {
+    const first = text[0];
+    const last = text[text.length - 1];
+    if (first === '"' && last === '"') {
+      return text.slice(1, -1).replace(/\\(["\\/])/g, '$1').replace(/\\n/g, '\n');
+    }
+    if (first === "'" && last === "'") {
+      return text.slice(1, -1).replace(/''/g, "'");
+    }
+  }
+  return text;
+}
+
+/**
+ * 把标量文本转成 JS 值：布尔、数字、字符串。
+ * @param {string} raw 原始值文本
+ * @returns {unknown} 解析结果
+ */
+function scalar(raw) {
+  const text = raw.trim();
+  if (text === '') return undefined;
+  const bare = text.replace(INLINE_COMMENT, '').trim();
+  if (/^(true|yes|on)$/i.test(bare)) return true;
+  if (/^(false|no|off)$/i.test(bare)) return false;
+  if (/^-?\d+$/.test(bare)) return Number(bare);
+  return unquote(bare);
+}
+
+/**
+ * 解析 frontmatter 文本块。
+ * @param {string} block 位于两条 `---` 之间的文本
+ * @returns {Record<string, unknown>} 解析出的键值对
+ */
+export function parseFrontmatterBlock(block) {
+  const data = {};
+  const lines = block.split('\n');
+  let index = 0;
+  while (index < lines.length) {
+    const line = lines[index].replace(/\r$/, '');
+    index += 1;
+    if (line.trim() === '' || line.trimStart().startsWith('#')) continue;
+    // 只认顶层键：缩进行属于上一个键的子结构，已在下面消费或忽略。
+    if (/^\s/.test(line)) continue;
+    const colon = line.indexOf(':');
+    if (colon <= 0) continue;
+    const key = line.slice(0, colon).trim();
+    if (key === '') continue;
+    const rest = line.slice(colon + 1);
+    if (rest.trim() !== '') {
+      data[key] = scalar(rest);
+      continue;
+    }
+    // 值为空：可能是缩进列表或嵌套映射。
+    const items = [];
+    let nested = {};
+    let hasNested = false;
+    while (index < lines.length) {
+      const next = lines[index].replace(/\r$/, '');
+      if (next.trim() === '') {
+        index += 1;
+        continue;
+      }
+      if (!/^\s/.test(next)) break;
+      index += 1;
+      const trimmed = next.trim();
+      if (trimmed.startsWith('- ') || trimmed === '-') {
+        items.push(scalar(trimmed.slice(1)));
+        continue;
+      }
+      const inner = trimmed.indexOf(':');
+      if (inner > 0) {
+        nested[trimmed.slice(0, inner).trim()] = scalar(trimmed.slice(inner + 1));
+        hasNested = true;
+      }
+    }
+    if (items.length > 0) data[key] = items;
+    else if (hasNested) data[key] = nested;
+    else data[key] = undefined;
+  }
+  return data;
+}
+
+/**
+ * 从完整的 SKILL.md 文本里切出 frontmatter 与正文。
+ * @param {string} raw 文件全文
+ * @returns {{data: Record<string, unknown>, body: string} | undefined} 解析结果
+ */
+export function splitFrontmatter(raw) {
+  const firstLineEnd = raw.indexOf('\n');
+  if (firstLineEnd < 0) return undefined;
+  if (raw.slice(0, firstLineEnd).replace(/\r$/, '') !== '---') return undefined;
+  const start = firstLineEnd + 1;
+  let lineStart = start;
+  while (lineStart <= raw.length) {
+    const nextNewline = raw.indexOf('\n', lineStart);
+    const lineEnd = nextNewline < 0 ? raw.length : nextNewline;
+    if (raw.slice(lineStart, lineEnd).replace(/\r$/, '') === '---') {
+      const bodyStart = nextNewline < 0 ? raw.length : nextNewline + 1;
+      return {
+        data: parseFrontmatterBlock(raw.slice(start, lineStart)),
+        body: raw.slice(bodyStart),
+      };
+    }
+    if (nextNewline < 0) return undefined;
+    lineStart = nextNewline + 1;
+  }
+  return undefined;
+}
+
+/**
+ * 按 DSH 的规则把布尔 frontmatter 字段转成布尔值。
+ * 与 `@deepseek-ai/dsh-skill-filesystem` 保持一致：接受布尔、1/0 与常见字符串拼写。
+ * @param {Record<string, unknown>} data frontmatter 数据
+ * @param {string} key 字段名
+ * @returns {boolean | undefined} 解析结果
+ */
+export function booleanField(data, key) {
+  if (!Object.hasOwn(data, key)) return undefined;
+  const value = data[key];
+  if (typeof value === 'boolean') return value;
+  if (value === 1 || value === '1') return true;
+  if (value === 0 || value === '0') return false;
+  if (typeof value === 'string') {
+    switch (value.toLowerCase()) {
+      case 'true':
+      case 'yes':
+      case 'on':
+        return true;
+      case 'false':
+      case 'no':
+      case 'off':
+        return false;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * 取出非空字符串字段。
+ * @param {Record<string, unknown>} data frontmatter 数据
+ * @param {string} key 字段名
+ * @returns {string | undefined} 字段值
+ */
+export function stringField(data, key) {
+  const value = data[key];
+  return typeof value === 'string' && value.length > 0 ? value : undefined;
+}

package/lib/index.js

@@ -0,0 +1,46 @@
+/**
+ * `dsh-compound-engineering`: 把 Every 的 compound-engineering 技能包移植进
+ * DeepSeek Harness。
+ *
+ * 插件本身没有存储、没有工具、没有 Web 界面——只做一件事：把随包分发的
+ * 36 个技能注册进 `ctx.skills`。所有行为都由技能正文驱动，因此未来的技能
+ * 更新只需要替换 `skills/` 目录，不必改动这份宿主代码。
+ */
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createProvider, PROVIDER_NAME } from './provider.js';
+
+/** 插件在 cordis 组合里的名字。 */
+export const name = 'compound-engineering';
+
+/**
+ * 依赖的技能注册表服务。
+ *
+ * 声明 `inject` 让 cordis 等技能服务就绪后再调用 `apply()`，插件被装到
+ * 一个没有技能子系统的宿主上时会安静地不生效，而不是抛错。
+ */
+export const inject = ['skills'];
+
+/** 技能目录相对包根的位置。 */
+const SKILLS_SUBDIRECTORY = 'skills';
+
+/** 由 `lib/index.js` 回推包根目录。 */
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+/**
+ * 把技能包挂到宿主上。
+ * @param ctx 宿主上下文
+ */
+export function apply(ctx) {
+  const skillsRoot = join(packageRoot, SKILLS_SUBDIRECTORY);
+  const logger = {
+    warn: (message) => ctx.logger.warn(message),
+    info: (message) => ctx.logger.info(message),
+  };
+  // 返回的 disposer 由 `registerProvider` 自己挂成 cordis effect，无需再包一层。
+  // `control.invalidate` 本插件用不到：技能是随包分发的静态文件，进程内不变。
+  ctx.skills.registerProvider(() => createProvider(skillsRoot, logger));
+  ctx.logger.info(`[${PROVIDER_NAME}] serving skills from ${skillsRoot}`);
+}
+
+export { PROVIDER_NAME };