dsh-rule-engine 0.3.0

package/lib/service.js

@@ -0,0 +1,174 @@
+// service.js —— 规则引擎 host 端 Remote 服务
+// 供设置面板（dsh-rules-manager-client 的“规则引擎”页签）通过 ctx.remote.ruleEngine.* 调用。
+// 与 rules-manager/service.js 同构：TypertRemoteService + 手动 @Remote 标记。
+import { readFileSync } from "node:fs";
+import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
+import { state } from "./core/runtime.js";
+import { readAuditLog } from "./core/audit.js";
+import { loadPluginConfig } from "./core/config.js";
+import { agentsFilePath, auditFilePath } from "./core/paths.js";
+
+const REMOTE_METHODS = [
+  "getStatus",
+  "getVersion",
+  "checkUpdate",
+  "getAuditLog",
+  "getUnderstanding"
+];
+
+function currentVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    return pkg.version || "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+
+function parseVersion(v) {
+  const s = String(v || "").replace(/^v/i, "");
+  const parts = s.split(".").map((n) => parseInt(n, 10) || 0);
+  return { major: parts[0] || 0, minor: parts[1] || 0, patch: parts[2] || 0 };
+}
+
+function isNewerVersion(a, b) {
+  const A = parseVersion(a);
+  const B = parseVersion(b);
+  if (B.major !== A.major) return B.major > A.major;
+  if (B.minor !== A.minor) return B.minor > A.minor;
+  return B.patch > A.patch;
+}
+
+class RuleEngineService extends TypertRemoteService {
+  static inject = [];
+
+  constructor(ctx) {
+    super(ctx, "ruleEngine");
+    for (const name of REMOTE_METHODS) {
+      Remote(null, {
+        kind: "method",
+        name,
+        private: false,
+        static: false,
+        addInitializer: (fn) => {
+          fn.call(this);
+        }
+      });
+    }
+  }
+
+  /** 引擎当前状态（版本/开关/规则数/审计路径/最近激活等） */
+  async getStatus() {
+    try {
+      const conf = loadPluginConfig();
+      return {
+        ok: true,
+        status: {
+          version: currentVersion(),
+          enabled: state.enabled,
+          configOk: state.configOk,
+          configError: state.configError || "",
+          rulesCount: state.configs.length,
+          mountRevision: state.mountRevision,
+          auditFile: auditFilePath(),
+          agentsFile: agentsFilePath(),
+          reloadCount: state.reloadCount,
+          lastActive: (state.lastActive || []).slice(0, 10)
+        }
+      };
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+  }
+
+  /** 当前版本号 */
+  async getVersion() {
+    return { ok: true, version: currentVersion() };
+  }
+
+  /**
+   * 检查 GitHub 最新 Release 与 upgrade-impact.json。
+   * 只读检查，不下载、不替换、不修改任何用户规则。
+   */
+  async checkUpdate() {
+    try {
+      const current = currentVersion();
+      const headers = { "User-Agent": "dsh-rule-engine", Accept: "application/vnd.github+json" };
+      const releaseRes = await fetch("https://api.github.com/repos/jilian-dsh/dsh-rule-engine/releases/latest", { headers });
+      if (!releaseRes.ok) {
+        return { ok: false, error: `GitHub Release 检查失败：HTTP ${releaseRes.status}` };
+      }
+      const release = await releaseRes.json();
+      const latestTag = String(release.tag_name || "").replace(/^v/i, "");
+      const hasUpdate = isNewerVersion(current, latestTag);
+
+      let impacts = [];
+      try {
+        const impactRes = await fetch("https://raw.githubusercontent.com/jilian-dsh/dsh-rule-engine/main/upgrade-impact.json", { headers: { "User-Agent": "dsh-rule-engine" } });
+        if (impactRes.ok) {
+          const data = await impactRes.json();
+          if (Array.isArray(data?.versions)) {
+            impacts = data.versions
+              .filter((v) => v && isNewerVersion(current, String(v.version || "").replace(/^v/i, "")))
+              .sort((a, b) => isNewerVersion(String(a.version || ""), String(b.version || "")) ? 1 : -1);
+          }
+        }
+      } catch {
+        // impact 文件拉取失败不影响 Release 检查结果
+      }
+
+      return {
+        ok: true,
+        current,
+        latest: {
+          tag_name: release.tag_name || "",
+          name: release.name || "",
+          published_at: release.published_at || "",
+          html_url: release.html_url || "",
+          body: release.body || "",
+          assets: Array.isArray(release.assets) ? release.assets.map((a) => ({
+            name: a.name,
+            browser_download_url: a.browser_download_url,
+            size: a.size
+          })) : []
+        },
+        hasUpdate,
+        impacts
+      };
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+  }
+
+  /** 最近审计日志（默认 10 条） */
+  async getAuditLog(n) {
+    try {
+      const count = Math.min(Math.max(1, Number(n) || 10), 200);
+      return { ok: true, entries: readAuditLog(count) };
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+  }
+
+  /** 规则理解摘要（ruleId/title/level/handler/confidence/actions） */
+  async getUnderstanding() {
+    try {
+      return {
+        ok: true,
+        rules: (state.configs || []).map((c) => ({
+          ruleId: c.ruleId,
+          title: c.title,
+          level: c.level || "",
+          handler: c.handler || "",
+          confidence: c.confidence || "",
+          actions: c.actions || [],
+          disabled: c.disabled === true
+        }))
+      };
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+  }
+}
+
+export { RuleEngineService, RuleEngineService as default };

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "dsh-rule-engine",
+  "version": "0.3.0",
+  "description": "DSH 规则执行引擎 v3：容器解析 AGENTS.md + 理解器 + 匹配机 + 执行框架",
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./lib/service.js": "./lib/service.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "scripts",
+    "upgrade-impact.json",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "deepseek-harness",
+    "dsh",
+    "dsh-plugin",
+    "cordis",
+    "rules",
+    "guard",
+    "security",
+    "agent"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/jilian-dsh/dsh-rule-engine.git"
+  },
+  "scripts": {
+    "test": "node test/run-all.js",
+    "check": "node --check lib/index.js",
+    "audit:mount": "node scripts/audit-mount-consistency.mjs --profile web"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/dsh-typert-protocol": ">=0.0.1-rc.3"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  }
+}

package/scripts/audit-mount-consistency.mjs

@@ -0,0 +1,198 @@
+// FULL mount-consistency audit: bundles vs user patch inserts vs bundle-internal patches vs dependencies
+// Goal: detect ANY loader entry id that would be mounted more than once (duplicate loader entry crash)
+import { readFileSync, existsSync, readdirSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { join, dirname } from 'node:path'
+
+const DSH_HOME = process.env.DSH_HOME || 'D:/DeepSeek harness/.dsh'
+const DEFAULT_PROFILE = 'web'
+function profileNameFromArgs() {
+  const argv = process.argv
+  let idx = argv.indexOf('--profile')
+  if (idx >= 0 && argv[idx + 1]) return argv[idx + 1]
+  const eq = argv.find((a) => a.startsWith('--profile='))
+  if (eq) return eq.slice('--profile='.length)
+  return DEFAULT_PROFILE
+}
+const PROFILE_NAME = profileNameFromArgs()
+const PROFILE = join(DSH_HOME, 'profiles', PROFILE_NAME)
+console.log(`Profile: ${PROFILE_NAME} -> ${PROFILE}`)
+if (!existsSync(join(PROFILE, 'package.json'))) {
+  console.error(`[ERROR] profile package.json not found: ${join(PROFILE, 'package.json')}`)
+  process.exit(2)
+}
+const profilePkg = JSON.parse(readFileSync(join(PROFILE, 'package.json'), 'utf8'))
+const requireFromProfile = createRequire(join(PROFILE, 'package.json'))
+
+/** 从 patch 文本提取 insert 块中的 loader entry id（支持块状和行内两种写法） */
+function extractInsertIds(text) {
+  const ids = []
+  const lines = String(text || '').split('\n')
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    if (!/^-\s*insert:/i.test(line)) continue
+    const rest = line.replace(/^-\s*insert:\s*/i, '')
+    if (rest.trim()) {
+      // 行内形式：- insert: { id: xxx } / - insert: - id: xxx
+      for (const m of rest.matchAll(/id:\s*["']?([^\s#"']+)/gi)) ids.push(m[1])
+      continue
+    }
+    // 块状形式：- insert: 后跟缩进的 - id: xxx
+    for (let j = i + 1; j < lines.length; j++) {
+      const l = lines[j]
+      if (/^\S/.test(l) && !/^\s/.test(l)) break // 回到顶层条目
+      const m = l.match(/^\s+- id:\s*["']?([^\s#"']+)/i)
+      if (m) ids.push(m[1])
+    }
+  }
+  return [...new Set(ids)]
+}
+
+/** 解析 bundle 包路径：优先 profile/node_modules，再 profiles/node_modules，最后用 Node 解析 */
+function resolveBundlePkg(b) {
+  const candidates = [
+    join(PROFILE, 'node_modules', b, 'package.json'),
+    join(DSH_HOME, 'profiles', 'node_modules', b, 'package.json')
+  ]
+  if (b.startsWith('@')) {
+    const [scope, name] = b.split('/')
+    candidates.push(join(DSH_HOME, 'profiles', 'node_modules', scope, name, 'package.json'))
+  }
+  for (const c of candidates) if (existsSync(c)) return c
+  try {
+    return requireFromProfile.resolve(`${b}/package.json`)
+  } catch {
+    return null
+  }
+}
+
+/** 读取一个 patch 文件并把其中的 insert id 记入 sources */
+function collectPatchInserts(patchPath, viaLabel) {
+  if (!existsSync(patchPath)) return []
+  const ids = extractInsertIds(readFileSync(patchPath, 'utf8'))
+  for (const id of ids) sources.push({ id, via: viaLabel, file: patchPath })
+  return ids
+}
+
+// ---- collect all sources of loader entry ids ----
+const sources = [] // {id, via, file}
+
+// 1. profile bundles array (each bundle's internal cordis.patch.yml inserts + the bundle row itself)
+const bundles = profilePkg.dsh?.profile?.bundles || []
+console.log('=== 1. profile bundles array (' + bundles.length + ') ===')
+for (const b of bundles) {
+  console.log('  bundle:', b)
+  const pkgPath = resolveBundlePkg(b)
+  if (!pkgPath) { console.log('    [WARN] package.json not found for ' + b); continue }
+  const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+  const patchRel = pkg.dsh?.bundle?.patch
+  if (patchRel) {
+    const patchPath = join(dirname(pkgPath), patchRel)
+    const inserts = collectPatchInserts(patchPath, `bundle-internal patch of ${b}`)
+    if (existsSync(patchPath)) {
+      console.log(`    internal patch ${patchRel}: inserts = ${inserts.length ? inserts.join(',') : '(none)'}`)
+    } else {
+      console.log('    [WARN] bundle patch missing: ' + patchPath)
+    }
+  }
+  // the bundle package itself may be a plugin row too (via loader) — record its name as entry candidate
+  // (bundle packages themselves are not loader entries; only their patch rows are)
+}
+
+// 2. user cordis.patch.yml inserts (profile layer)
+const userPatchPath = join(PROFILE, 'cordis.patch.yml')
+const userPatch = readFileSync(userPatchPath, 'utf8')
+console.log('\n=== 2. user cordis.patch.yml (profile layer) ===')
+const userInserts = collectPatchInserts(userPatchPath, 'user patch insert')
+// also non-insert top-level entries (override/disable by id) — these do NOT create entries but list them
+const topLevelIds = [...userPatch.matchAll(/^-\s+id:\s+([^\s#]+)/gm)].map((m) => m[1])
+console.log('  user patch top-level ids:', topLevelIds.join(',') || '(none)')
+console.log('  user patch inserts:', userInserts.join(',') || '(none)')
+
+// 2.5 root user cordis.patch.yml inserts (if present)
+const rootPatchPath = join(DSH_HOME, 'cordis.patch.yml')
+const rootInserts = []
+if (existsSync(rootPatchPath)) {
+  console.log('\n=== 2.5 root user cordis.patch.yml ===')
+  rootInserts.push(...collectPatchInserts(rootPatchPath, 'root user patch insert'))
+  console.log('  root user patch inserts:', rootInserts.join(',') || '(none)')
+} else {
+  console.log('\n=== 2.5 root user cordis.patch.yml ===')
+  console.log('  (no root cordis.patch.yml)')
+}
+
+// 3. dependencies with link/github/http (local dev packages) — check their type
+console.log('\n=== 3. dependencies type check ===')
+const deps = profilePkg.dependencies || {}
+for (const [name, spec] of Object.entries(deps)) {
+  const isLocal = typeof spec === 'string' && (spec.startsWith('link:') || spec.startsWith('github:') || spec.startsWith('http') || spec.startsWith('file:'))
+  console.log(`  ${name}: ${spec} ${isLocal ? '(LOCAL/dev)' : ''}`)
+  if (isLocal) {
+    // resolve local dir and check dsh type
+    let dir = null
+    if (spec.startsWith('link:')) dir = spec.slice(5)
+    else if (spec.startsWith('file:')) dir = spec.slice(5)
+    else if (spec.startsWith('github:') || spec.startsWith('http')) dir = join(PROFILE, 'node_modules', name)
+    if (dir) {
+      const lp = join(dir.replace(/\\/g, '/'), 'package.json')
+      if (existsSync(lp)) {
+        const lpj = JSON.parse(readFileSync(lp, 'utf8'))
+        const dshType = lpj.dsh?.bundle ? 'dsh.bundle' : (lpj.dsh?.plugin ? 'dsh.plugin' : (lpj.dsh ? JSON.stringify(lpj.dsh) : 'no dsh field'))
+        const inBundles = bundles.includes(name)
+        const inUserPatch = userInserts.includes(name) || rootInserts.includes(name) || topLevelIds.includes(name)
+        console.log(`    -> type: ${dshType} | inBundles: ${inBundles} | inUserPatch: ${inUserPatch}`)
+        // rule 24: dsh.plugin must NOT be in bundles; dsh.bundle SHOULD be in bundles not in user patch insert
+        if (dshType === 'dsh.plugin' && inBundles) {
+          console.log('    [VIOLATION rule24] dsh.plugin in bundles!')
+        }
+        if (dshType === 'dsh.bundle' && inUserPatch) {
+          console.log('    [WARN] dsh.bundle also present in user patch — check duplicate')
+        }
+      }
+    }
+  }
+}
+
+// 3.5 runtime injection registry (super-injector) — also produces loader entries
+console.log('\n=== 3.5 runtime injection registry ===')
+const superInjectorRegistry = join(DSH_HOME, 'super-injector', 'registry.json')
+try {
+  if (existsSync(superInjectorRegistry)) {
+    const reg = JSON.parse(readFileSync(superInjectorRegistry, 'utf8'))
+    if (!Array.isArray(reg)) throw new Error('registry.json is not an array')
+    const names = reg.map((e) => e && e.name).filter(Boolean)
+    for (const name of names) {
+      sources.push({ id: name, via: 'runtime injection (super-injector registry)', file: superInjectorRegistry })
+    }
+    console.log('  runtime injected:', names.join(', ') || '(none)')
+  } else {
+    console.log('  (no super-injector registry found; if dev_inject_plugin has been used, run dev_injected_list to confirm)')
+  }
+} catch (e) {
+  console.log('  [WARN] failed to read super-injector registry:', e instanceof Error ? e.message : String(e))
+}
+
+// 4. duplicate detection across ALL sources
+console.log('\n=== 4. DUPLICATE LOADER ENTRY DETECTION ===')
+const byId = new Map()
+for (const s of sources) {
+  if (!byId.has(s.id)) byId.set(s.id, [])
+  byId.get(s.id).push(s)
+}
+let dupFound = false
+for (const [id, list] of byId) {
+  if (list.length > 1) {
+    dupFound = true
+    console.log(`  [DUPLICATE] id "${id}" mounted ${list.length} times:`)
+    for (const s of list) console.log(`    - via ${s.via} (${s.file})`)
+  }
+}
+if (!dupFound) console.log('  NO duplicate loader entry ids found — clean')
+
+// 5. also check bundle rows vs their internal patch first insert (self-reference is fine)
+console.log('\n=== 5. summary ===')
+console.log('  bundles:', bundles.join(', '))
+console.log('  user inserts:', userInserts.join(',') || '(none)')
+console.log('  root user inserts:', rootInserts.join(',') || '(none)')
+console.log(dupFound ? '  RESULT: DUPLICATES FOUND — MUST FIX BEFORE RESTART' : '  RESULT: MOUNT CONSISTENT — SAFE TO RESTART')
+process.exit(dupFound ? 1 : 0)

package/scripts/build.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")/.."
+node --check lib/index.js
+node --check lib/core/parser.js
+node --check lib/core/understander.js
+node --check lib/core/patterns.js
+node --check lib/core/state.js
+node --check lib/core/audit.js
+node --check lib/core/guard-core.js
+node --check lib/core/text-detect.js
+node --check lib/core/matcher.js
+echo "build check ok"

package/scripts/check-real.mjs

@@ -0,0 +1,24 @@
+// check-real.mjs - 只读校验：用真实 ~/.dsh/AGENTS.md 跑解析+理解，不写任何文件。
+import { loadRules } from "../lib/core/parser.js";
+import { understandAll } from "../lib/core/understander.js";
+
+const parsed = loadRules();
+if (!parsed.ok) {
+  console.error(JSON.stringify({ ok: false, error: parsed.error }, null, 2));
+  process.exit(1);
+}
+const configs = understandAll(parsed.rules);
+const summary = {
+  ok: true,
+  ruleCount: parsed.rules.length,
+  sections: [...new Set(parsed.rules.map((r) => r.section))],
+  confidence: configs.reduce((acc, c) => {
+    acc[c.confidence] = (acc[c.confidence] || 0) + 1;
+    return acc;
+  }, {}),
+  actions: configs.reduce((acc, c) => {
+    for (const a of c.actions) acc[a] = (acc[a] || 0) + 1;
+    return acc;
+  }, {})
+};
+console.log(JSON.stringify(summary, null, 2));

package/upgrade-impact.json

@@ -0,0 +1,55 @@
+{
+  "versions": [
+    {
+      "version": "0.2.1",
+      "summary": "version-guard 放行非表格单行修改（整行替换但行首锚点一致），避免 edit 工具修改规则正文被误回滚",
+      "impacts": [
+        {
+          "rule": "25",
+          "level": "behavior-change",
+          "description": "validateEditAppend 新增非表格单行替换放行：行首锚点足够长且规则编号一致时允许整行修改；版本表格行仍保持仅重编号放行。"
+        }
+      ],
+      "userRulesUnaffected": true,
+      "notes": "升级只更新规则引擎插件本身，不修改 AGENTS.md / SKILL.md / 用户自定义规则。"
+    },
+    {
+      "version": "0.2.0",
+      "summary": "规则引擎设置面板、升级检查与影响展示；规则 19/21/22/24/25/27 执行口径升级",
+      "impacts": [
+        {
+          "rule": "19",
+          "level": "behavior-change",
+          "description": "知识沉淀载体从“仅手册”扩展为可选技能/脚本/仓库文档等；不改变用户已写规则文本。"
+        },
+        {
+          "rule": "21",
+          "level": "behavior-change",
+          "description": "规则审批改为分级确认，并新增“选项即边界”；不改变既有规则语义。"
+        },
+        {
+          "rule": "22",
+          "level": "behavior-change",
+          "description": "被指出错误时需主动给出原因/改正/防再犯；引擎新增 D 级自证提醒。"
+        },
+        {
+          "rule": "27",
+          "level": "behavior-change",
+          "description": "装配变更检测从会话级改为全局 mountRevision + 本会话审计证据；其他会话未审计也会被拦。"
+        },
+        {
+          "rule": "24",
+          "level": "behavior-change",
+          "description": "新增手工编辑 profile package.json 的 dsh.profile.bundles 类型检查。"
+        },
+        {
+          "rule": "25",
+          "level": "behavior-change",
+          "description": "新增 dev_stage_add/call/promote/demote 通用执行器纳入覆盖与敏感授权检查。"
+        }
+      ],
+      "userRulesUnaffected": true,
+      "notes": "升级只更新规则引擎插件本身，不修改 AGENTS.md / SKILL.md / 用户自定义规则。"
+    }
+  ]
+}