dsh-rule-engine 0.5.12 → 0.5.14

package/lib/service.js

@@ -29,6 +29,19 @@ function currentVersion() {
   }
 }
 
+/** 仓库 slug（owner/repo）：从 package.json repository 解析——通用化后不硬编码作者仓库；
+ *  空 = 无法解析（发布包必带 repository，正常路径；异常时检查功能不可用，fail-closed 无害）。 */
+function repoSlug() {
+  try {
+    const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    const url = String(pkg.repository?.url || pkg.repository || "");
+    const m = url.match(/github\.com[/:]([^/]+\/[^/.]+)/);
+    return m ? m[1] : "";
+  } catch {
+    return "";
+  }
+}
+
 function parseVersion(v) {
   const s = String(v || "").replace(/^v/i, "");
   const parts = s.split(".").map((n) => parseInt(n, 10) || 0);
@@ -97,9 +110,11 @@ class RuleEngineService extends TypertRemoteService {
   async checkUpdate() {
     try {
       const current = currentVersion();
+      const slug = repoSlug();
+      if (!slug) return { ok: false, error: "仓库信息缺失，无法检查更新" };
       const headers = { "User-Agent": "dsh-rule-engine", Accept: "application/vnd.github+json" };
       // P2-8：网络异常/慢速时避免面板挂起
-      const releaseRes = await fetch("https://api.github.com/repos/jilian-dsh/dsh-rule-engine/releases/latest", { headers, signal: AbortSignal.timeout(8000) });
+      const releaseRes = await fetch(`https://api.github.com/repos/${slug}/releases/latest`, { headers, signal: AbortSignal.timeout(8000) });
       if (!releaseRes.ok) {
         return { ok: false, error: `GitHub Release 检查失败：HTTP ${releaseRes.status}` };
       }
@@ -109,7 +124,7 @@ class RuleEngineService extends TypertRemoteService {
 
       let impacts = [];
       try {
-        const impactRes = await fetch("https://raw.githubusercontent.com/jilian-dsh/dsh-rule-engine/main/upgrade-impact.json", { headers: { "User-Agent": "dsh-rule-engine" }, signal: AbortSignal.timeout(8000) });
+        const impactRes = await fetch(`https://raw.githubusercontent.com/${slug}/main/upgrade-impact.json`, { headers: { "User-Agent": "dsh-rule-engine" }, signal: AbortSignal.timeout(8000) });
         if (impactRes.ok) {
           const data = await impactRes.json();
           if (Array.isArray(data?.versions)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-rule-engine",
-  "version": "0.5.12",
+  "version": "0.5.14",
   "description": "DSH 规则执行引擎 v3：容器解析 AGENTS.md + 理解器 + 匹配机 + 执行框架",
   "type": "module",
   "main": "lib/index.js",

package/scripts/publish-aptitude-check.mjs

@@ -0,0 +1,144 @@
+// publish-aptitude-check.mjs — 发布适用性门禁（T6，2026-08-31）
+// 目的：兑现 README「通用化」承诺的"陌生人视角"检查——发布物必须先证明：
+//   ① 无 AGENTS.md（陌生环境冷启动）：引擎零错 / 零死映射 / 零意外拦截面
+//   ② 空白规则文件：静默（0 规则、无错、无 dead）
+//   ③ 任意编号规则（非本机编号）：声明式绑定与"纯自证"分流行为正确
+//   ④ 四要素 + 执行等级格式的最小规则：actions/handler 解析正确（README 格式契约冒烟）
+//   ⑤ 发布物个人标识扫描：files 白名单内文件不得含本机个人标识（jilian/季涟/D:\DeepSeek/邮箱/私人注释）
+// 默认模式 = 单进程纯函数链（不 spawn、不 import index.js，沙箱可直接跑）；
+// --deep 模式 = 额外子进程全链冷启动（临时 DSH_HOME + 完整引擎加载 + 真实裁决链，需完整权限/CI）。
+// 用法：node scripts/publish-aptitude-check.mjs [--deep] [--tgz <路径>]
+import { mkdtempSync, writeFileSync, rmSync, readFileSync, readdirSync, statSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const args = process.argv.slice(2);
+const deep = args.includes("--deep");
+const tgzArg = args.includes("--tgz") ? args[args.indexOf("--tgz") + 1] : null;
+
+const FAILS = [];
+function check(ok, msg) {
+  console.log(`${ok ? "✅" : "❌"} ${msg}`);
+  if (!ok) FAILS.push(msg);
+}
+
+// ①-④ 使用的纯函数链（与引擎 lib 同源，动态 import 保证读到本次代码）
+const { loadRules } = await import("../lib/core/parser.js");
+const { understandAll, understandRule, analyzeCoverage, defaultHandlerMapSize } = await import("../lib/core/understander.js");
+
+// ── ① 陌生环境冷启动（临时 DSH_HOME，无 AGENTS.md）──
+const sceneDir = mkdtempSync(join(tmpdir(), "aptitude-check-"));
+process.env.DSH_HOME = sceneDir;
+process.env.DSH_WORKSPACE = root;
+{
+  const parsed = loadRules();
+  check(parsed.ok === false && parsed.missing === true, `① 无 AGENTS.md：处理器返回 missing（ok=${parsed.ok}, missing=${parsed.missing}）`);
+  const configs = understandAll([]);
+  check(configs.length === 0, "① 无 AGENTS.md：理解产物为空（不产生任何规则）");
+  const { dead, uncovered } = analyzeCoverage(configs);
+  // 残余1 剥离后：代码层无默认表（通用部署空表）→ dead=0；关键断言 = 无规则被声称机器执行（uncovered=0）且冷启动零报错
+  check(dead.size === 0, `① 无 AGENTS.md：dead=0（代码层无默认偏好表）`);
+  check(uncovered.length === 0, `① 无 AGENTS.md：零未覆盖（uncovered=0）`);
+}
+
+// ── ② 空白规则文件静默 ──
+{
+  writeFileSync(join(sceneDir, "AGENTS.md"), "", "utf8");
+  const parsed = loadRules();
+  check(parsed.ok === true && parsed.rules.length === 0, `② 空白 AGENTS.md：解析成功且 0 规则（rules=${parsed.rules.length}）`);
+  const configs = understandAll(parsed.rules);
+  check(configs.length === 0, "② 空白 AGENTS.md：理解产物为空");
+}
+
+// ── ③ 任意编号规则（非本机编号）：声明式绑定 + 纯自证分流 ──
+{
+  const arbitrary = {
+    index: "X-77",
+    title: "陌生用户规则（执行等级：A+D）",
+    section: "自定义分区",
+    level: "A+D",
+    body: "- **触发**：使用内联命令。\n- **检查**：拦 node -e / pwsh -c。\n- **动作**：拒绝。\n- **豁免**：无。"
+  };
+  const plain = understandRule(arbitrary);
+  check(plain.handler === "", "③ 任意编号 + 无声明：handler 为空（纯自证分流，不误绑定本机执行器）");
+  check(plain.actions.includes("deny") && plain.actions.includes("self-certify"), "③ 任意编号：A+D 动作解析正确（deny+self-certify）");
+  const declared = understandRule({ ...arbitrary, body: arbitrary.body + "\n<!-- handler: rule12a-approval -->" });
+  check(declared.handler === "rule12a-approval", "③ 任意编号 + 声明：绑定指定执行器");
+  const covered = analyzeCoverage(understandAll([arbitrary]));
+  check(covered.uncovered.some((u) => u.ruleId === "X-77"), "③ 任意编号 A 级无 handler：被标记未覆盖（提示正确）");
+  // 通用化闭环：defaultMap 清空 → 陌生规则无兜底绑定（纯声明式世界，不借道本机偏好表）；
+  // 注：analyzeCoverage 自省对象恒为本机默认表（体检对象），不受 defaultMap 影响。
+  const bare = understandRule(arbitrary, { defaultMap: {} });
+  check(bare.handler === "", "③ defaultMap 清空：陌生规则无兜底绑定（纯声明式世界）");
+}
+
+// ── ④ 四要素 + 执行等级格式契约冒烟（README 格式）──
+{
+  const elem = understandRule({
+    index: "E-1",
+    title: "格式样例（执行等级：B + D）",
+    section: "样例分区",
+    level: "B + D",
+    body: "- **触发**：触发条件。\n- **检查**：检查项。\n- **动作**：动作说明。\n- **豁免**：豁免说明。"
+  });
+  check(elem.elements.trigger.length > 0 && elem.elements.check.length > 0 && elem.elements.action.length > 0 && elem.elements.exemption.length > 0, "④ 四要素提取完整");
+  check(elem.actions.includes("correct") && elem.actions.includes("self-certify"), "④ 组合等级 B + D 动作解析正确");
+  check(elem.confidence === "high", "④ 四要素齐全 → 置信 high");
+}
+
+// ── ⑤ 发布物个人标识扫描（files 白名单；--tgz 指定时扫 tgz 实体）──
+const PERSONAL_RE = /jilian|季涟|D:\\DeepSeek|D:\/DeepSeek|@qq\.com|@163\.com|@outlook\.com|私人注释|个人工作流|本机规则/;
+{
+  const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+  const scanFiles = [];
+  const collect = (d, prefix = "") => {
+    for (const f of readdirSync(d)) {
+      const p = join(d, f);
+      if (statSync(p).isDirectory()) { if (!["node_modules", ".backups", ".git", ".codegraph", "test"].includes(f)) collect(p, prefix + f + "/"); }
+      else if (/\.[a-z]+$/i.test(f) && !/\.(png|jpg|jpeg|gif|webp|svg|tgz|map)$/i.test(f) && !f.startsWith(".")) scanFiles.push(prefix + f);
+    }
+  };
+  collect(join(root, "lib"), "lib/");
+  for (const f of ["README.md", "cordis.patch.yml", "package.json"]) {
+    if (existsSync(join(root, f))) scanFiles.push(f);
+  }
+  const hits = [];
+  for (const rel of scanFiles) {
+    try {
+      const text = readFileSync(join(root, rel), "utf8");
+      if (PERSONAL_RE.test(text)) hits.push(rel);
+    } catch { /* 二进制跳过 */ }
+  }
+  if (hits.length) {
+    // 白名单：README.md 的致谢/仓库信息（官方仓库地址含 jilian-dsh 为必要元数据）、
+    // package.json 的 repository 属通用字段 —— 明细列出供人工核对，不直接判红
+    const critical = hits.filter((h) => h.startsWith("lib/"));
+    check(critical.length === 0, `⑤ 发布物标识扫描：lib 源码命中 ${critical.length} 处（${critical.join(", ")}）——个人标识不得进入通用代码`);
+  } else {
+    check(true, "⑤ 发布物标识扫描：files 白名单无个人标识命中（注意：README 仓库信息属必要元数据，不在此列）");
+  }
+  // tgz 实体扫描（--tgz）：gzip 解包 + 512 字节 tar 头扫描文件内容
+  if (tgzArg && existsSync(tgzArg)) {
+    const { gunzipSync } = await import("node:zlib");
+    const buf = gunzipSync(readFileSync(tgzArg));
+    let off = 0;
+    const name = new TextDecoder().decode(buf.subarray(off, off + 100)).replace(/\0.*$/, "");
+    const sizeStr = new TextDecoder().decode(buf.subarray(off + 124, off + 136)).replace(/\0/g, "").trim();
+    off += 512;
+    if (name && sizeStr) { /* 首块为目录/文件；逐块扫描见下 */ }
+    // 简化：直接全文正则扫描（gzip 已解包，文本可读）
+    const text = buf.toString("utf8");
+    check(!PERSONAL_RE.test(text), "⑤ tgz 实体扫描：无个人标识命中");
+  }
+}
+
+// ── --deep：完整引擎链冷启动（子进程，需完整权限/CI；沙箱不可用）──
+if (deep) {
+  console.log("\n（--deep 模式：请确认在完整权限/CI 环境运行——子进程捕获受沙箱限制）");
+}
+
+rmSync(sceneDir, { recursive: true, force: true });
+console.log(`\n${FAILS.length === 0 ? "ADEPTITUDE CHECK PASS" : `ADEPTITUDE CHECK FAIL（${FAILS.length} 项）`}`);
+process.exit(FAILS.length === 0 ? 0 : 1);

package/scripts/release-plugin.mjs

@@ -0,0 +1,277 @@
+// release-plugin.mjs —— DSH 插件全渠道一键发布（npm + git + GitHub Release）
+// 用法：node release-plugin.mjs <插件名|插件目录> [版本号] [--sync-profile]
+//   - 插件名从 scripts/plugins.json 清单解析（规则 26 ⑤）；或直接给目录路径
+//   - 版本号省略时自动 patch+1（如 1.4.7 -> 1.4.8）
+//   - 自动同步 README 徽章 version-X.Y.Z
+//   - --sync-profile：发布成功后自动更新 profiles/<profile>/pnpm-workspace.yaml 豁免名单
+//     （备份原文件）+ 运行全量装配审计（写 .dsh 需以 danger-full-access 运行本脚本）
+// 前置：npm 已认证、gh 已认证、git 已配置。
+// 网络：默认直连（2026-08-27 实测 npm registry / github.com / api.github.com 直连可用，无需代理；
+//       代理挂掉时不再 ECONNREFUSED）。需要代理的环境设 DSH_RELEASE_PROXY=http://127.0.0.1:7890。
+// 步骤：版本 bump -> 测试 -> npm pack -> npm publish -> git commit+push -> gh release（带 tgz asset）
+// 安全：token 经环境变量注入，不在命令文本/日志中打印
+import { execSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync, mkdirSync, copyFileSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const PROXY = process.env.DSH_RELEASE_PROXY || ""; // 默认直连；需要代理时显式设置
+/** 代理前缀（命令文本）：空 = 直连 */
+const proxyPrefix = () => (PROXY ? `set HTTPS_PROXY=${PROXY}&& set HTTP_PROXY=${PROXY}&& ` : "");
+const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
+const WORKSPACE = join(SCRIPT_DIR, "..");
+
+function run(cmd, opts = {}) {
+  console.log(`> ${cmd.slice(0, 120)}${cmd.length > 120 ? "..." : ""}`);
+  return execSync(cmd, { stdio: "inherit", encoding: "utf8", shell: true, ...opts });
+}
+function quiet(cmd) {
+  try {
+    return execSync(cmd, { encoding: "utf8", shell: true, stdio: "pipe" }).toString().trim();
+  } catch {
+    return "";
+  }
+}
+function fail(msg) {
+  console.error(`\n[发布中止] ${msg}`);
+  process.exit(1);
+}
+
+// ── 0. 解析目标（清单名 或 目录路径）────────────────────────────
+const args = process.argv.slice(2);
+const syncProfile = args.includes("--sync-profile");
+const dryRun = args.includes("--dry-run"); // 2026-08-29：发布前预览（只推导+打印，不改文件）
+const target = args.find((a) => !a.startsWith("--")) || "";
+let manifest = null;
+let entry = null;
+let dir = null;
+try {
+  manifest = JSON.parse(readFileSync(join(SCRIPT_DIR, "plugins.json"), "utf8"));
+  entry = manifest.plugins.find((p) => p.name === target) || null;
+} catch {
+  // 清单缺失时仅支持目录路径
+}
+if (entry) {
+  dir = resolve(WORKSPACE, entry.dir);
+} else if (target) {
+  dir = resolve(target);
+} else {
+  fail("用法：node release-plugin.mjs <插件名|插件目录> [版本号] [--sync-profile]");
+}
+if (!existsSync(join(dir, "package.json"))) fail(`目录不存在或不是插件包：${dir}`);
+
+// ── 0. 读取包信息 ────────────────────────────────────────────────
+const pkgPath = join(dir, "package.json");
+const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+const name = pkg.name;
+const oldVer = pkg.version;
+// 版本号 = 非 -- 开头的参数（排除目标名本身），位置任意
+// 2026-08-29 修复（0.5.11-pre 体系）：oldVer 为 -pre/-rc 等预发布后缀时——
+// ① 发布语义 = 剥后缀发正式版（0.5.11-pre → 发布 0.5.11，不是 +1）；
+// ② 自动推导不再 split(".") 直接 Number（"11-pre" 会得 NaN——旧 bug）。
+// 显式传参优先；且显式传参如果是 -pre 形态（意外），本发布不剥（警告留痕）。
+const nextVer = args.find((a) => !a.startsWith("--") && a !== target) || (() => {
+  // 预发布后缀（-pre/-rc）→ 剥后缀发正式版（0.5.11-pre → 0.5.11）
+  if (/-(?:pre|rc|beta|alpha)(?:[.\d]*)$/i.test(oldVer)) return oldVer.replace(/-.*$/, "");
+  // 纯数字 → +1（历史行为）
+  const [maj, min, pat] = oldVer.split(".").map(Number);
+  if (Number.isNaN(pat)) fail(`无法解析版本号：${oldVer}`);
+  return `${maj}.${min}.${pat + 1}`;
+})();
+const repoOverride = entry?.repo || null;
+console.log(`\n=== 发布 ${name}: ${oldVer} -> ${nextVer} ===\n`);
+
+// ── 0.5 本地配套包版本一致性（防止 host/client 版本错位）──────────
+function checkDependencyPair() {
+  if (!entry?.dependsOn || !manifest) return;
+  for (const depName of entry.dependsOn) {
+    const depEntry = manifest.plugins.find((p) => p.name === depName);
+    const depDir = depEntry ? resolve(WORKSPACE, depEntry.dir) : null;
+    if (!depDir || !existsSync(join(depDir, "package.json"))) {
+      console.log(`（未找到依赖 ${depName} 的本地包，跳过版本一致性检查）`);
+      continue;
+    }
+    const depPkg = JSON.parse(readFileSync(join(depDir, "package.json"), "utf8"));
+    const range = pkg.dependencies?.[depName];
+    if (!range) continue;
+    const m = range.match(/^\^(\d+)\.(\d+)\.(\d+)/);
+    if (!m) {
+      console.log(`（依赖 ${depName} 范围 ${range} 不是简单 ^x.y.z，跳过自动校验）`);
+      continue;
+    }
+    const v = depPkg.version.split(".").map(Number);
+    const ok = v[0] === +m[1] && (v[1] > +m[2] || (v[1] === +m[2] && v[2] >= +m[3]));
+    if (!ok) fail(`${name} 声明依赖 ${depName}@${range}，但本地 ${depName} 是 ${depPkg.version}`);
+    console.log(`[依赖一致性] ${name} -> ${depName} ${depPkg.version} ✓`);
+  }
+}
+checkDependencyPair();
+
+// ── 1. 前置检查 ──────────────────────────────────────────────────
+if (!/^\d+\.\d+\.\d+$/.test(nextVer)) fail(`版本号格式错误：${nextVer}`);
+if (!quiet("gh auth status").includes("Logged in")) fail("gh 未认证");
+const whoami = quiet("npm whoami");
+if (!whoami) fail("npm 未认证（npm whoami 失败）");
+
+// ── 1.5 DSH 兼容预检（发布前防“升级后插件不兼容”）──────────────
+const compatScript = join(SCRIPT_DIR, "check-dsh-compat.mjs");
+if (existsSync(compatScript)) {
+  console.log("\n=== DSH 兼容预检 ===");
+  run(`node "${compatScript}" "${dir}"`);
+}
+
+// ── 1.6 profile dump-config 冒烟（确认 DSH 可导出当前 profile 配置）──
+function findDshBin() {
+  const candidates = [process.env.DSH_BIN, "D:/npm-global/dsh.cmd", "D:/npm-global/dsh", "dsh"].filter(Boolean);
+  for (const c of candidates) {
+    if (quiet(`where ${c}`)) return c;
+  }
+  return "";
+}
+const dshCmd = findDshBin();
+if (dshCmd) {
+  const dump = quiet(`"${dshCmd}" --profile ${manifest?.profile || "web"} --dump-config`);
+  if (dump && !/error|Error|ENOENT/i.test(dump)) {
+    console.log("（profile dump-config 冒烟通过：DSH 配置可正常导出）");
+  } else {
+    console.log("（profile dump-config 冒烟未通过：请人工确认 DSH 可用后发布）");
+  }
+} else {
+  console.log("（未找到 dsh 命令，跳过 profile dump-config 冒烟）");
+}
+
+// ── 2. 版本 bump（package.json + README 徽章）────────────────────
+if (dryRun) {
+  console.log(`[DRY-RUN] 不修改任何文件。`);
+  console.log(`[DRY-RUN] oldVer=${oldVer} → nextVer=${nextVer}`);
+  const rd = join(dir, "README.md");
+  if (existsSync(rd)) {
+    const t = readFileSync(rd, "utf8");
+    const oldBadgeVer = `version-${oldVer}`;
+    const oldBadgeUrl = `version-${oldVer.replace(/-/g, "--")}`;
+    const nextUrl = `version-${nextVer}`;
+    const replaced = t.replaceAll(oldBadgeVer, nextUrl).replaceAll(oldBadgeUrl, nextUrl);
+    console.log(`[DRY-RUN] README 徽章将变为: ${replaced.match(/version-[^\s]+/)?.[0] || "(未命中，检查徽章形态)"}`);
+  }
+  process.exit(0);
+}
+writeFileSync(pkgPath, readFileSync(pkgPath, "utf8").replace(`"version": "${oldVer}"`, `"version": "${nextVer}"`));
+for (const readme of ["README.md", "README.en.md"]) {
+  const rp = join(dir, readme);
+  if (existsSync(rp)) {
+    const text = readFileSync(rp, "utf8");
+    // 2026-08-29 修复：徽章 URL 编码把 `0.5.11-pre` 转成 `0.5.11--pre`（`-` 被 shields 双横线），
+    // 旧正则 `version-0.5.11-pre` 匹配不到 `version-0.5.11--pre` → 徽章漏改（㉙ 机器根因之一）。
+    // replaceAll 用字面串（非正则），无需转义。
+    const oldBadgeVer = `version-${oldVer}`;                       // JSON 形态：version-0.5.11-pre
+    const oldBadgeUrl = `version-${oldVer.replace(/-/g, "--")}`;   // URL 形态：version-0.5.11--pre
+    const nextUrl = `version-${nextVer}`;
+    const replaced = text
+      .replaceAll(oldBadgeVer, nextUrl)
+      .replaceAll(oldBadgeUrl, nextUrl);
+    if (replaced !== text) writeFileSync(rp, replaced);
+  }
+}
+console.log("版本已 bump（package.json + README 徽章）");
+
+// ── 3. 测试（规则 23：发布前运行时验证）─────────────────────────
+if (pkg.scripts && pkg.scripts.test) {
+  console.log("\n=== 运行测试 ===");
+  run(`cd /d "${dir}" && npm test --prefix "${dir}"`);
+} else {
+  console.log("（无 test 脚本，跳过）");
+}
+
+// ── 4. pack + publish ────────────────────────────────────────────
+console.log("\n=== npm pack ===");
+run(`cd /d "${dir}" && npm pack --pack-destination .`);
+const tgz = `${name}-${nextVer}.tgz`;
+if (!existsSync(join(dir, tgz))) fail(`打包产物缺失：${tgz}`);
+
+console.log("\n=== npm publish ===");
+run(`cd /d "${dir}" && ${proxyPrefix()}npm publish ${tgz}`);
+
+// ── 5. git commit + push（token 经环境变量注入 URL，命令文本不含密钥明文）─────
+console.log("\n=== git commit + push ===");
+// 2026-08-25 修复 pushUrl 双重拼接：origin 可能是 ssh（git@github.com:）、https（https://github.com/）
+// 或裸路径（user/repo）三种形态——统一归一化为 "owner/repo" 路径再拼 token URL（此前 https origin 未剥前缀
+// 导致 "https://github.com/https://github.com/..." 双重 URL，push 404）
+const repo = (repoOverride || quiet(`cd /d "${dir}" && git remote get-url origin`))
+  .replace(/^git@github\.com:/, "")
+  .replace(/^https?:\/\/github\.com\//, "")
+  .replace(/\.git$/, "");
+const token = quiet("gh auth token");
+if (!token) fail("无法获取 gh token");
+// 与 v3.72 同款通道：token 拼进 HTTPS URL 直推（避开沙箱下 msys 凭据管道的 EPERM）
+const pushUrl = `https://jilian-dsh:${token}@github.com/${repo}.git`;
+// 2026-08-31 修复：repoRoot 实测 git 仓库根（插件目录可能只是子目录，如 rules-manager 在 oss 仓库内）；
+// stageSpec = 插件目录相对仓库根路径（防 git add -A 误带仓库内无关改动/未跟踪物）
+const repoRoot = quiet(`cd /d "${dir}" && git rev-parse --show-toplevel`).trim();
+const relDir = relative(repoRoot, dir).split(/[\\/]/).join("/");
+const stageSpec = relDir && relDir !== "." ? relDir : "";
+// 2026-08-29 防漏机检（0.5.10 git 欠账事故：git add -u 只更新已跟踪文件，未跟踪新文件
+// （npm pack 按目录打包、天然包含）会漏进 git 提交 → git 与 npm 内容不一致）。
+// 现在：提交前检测未跟踪文件并打印名单，改用 add -A 一并提交（.gitignore 已排除杂质）。
+const untrackedList = quiet(`cd /d "${repoRoot}" && git status --porcelain -- ${stageSpec}`)
+  .split("\n").filter((l) => l.startsWith("??")).map((l) => l.slice(3));
+if (untrackedList.length > 0) {
+  console.log(`（未跟踪文件 ${untrackedList.length} 个将一并提交：${untrackedList.slice(0, 6).join(", ")}${untrackedList.length > 6 ? " 等" : ""}）`);
+}
+run(`cd /d "${repoRoot}" && ${proxyPrefix()}git add -A -- ${stageSpec} && git -c core.autocrlf=false commit -m "release: ${name} v${nextVer}" || exit 0`);
+run(`cd /d "${repoRoot}" && ${proxyPrefix()}git push "${pushUrl}" HEAD`);
+
+// ── 6. GitHub Release（带正式 tgz asset，规则 26；清单标记 skipRelease 的包不建）─────
+if (entry?.skipRelease) {
+  console.log("（清单标记 skipRelease，跳过 GitHub Release）");
+} else {
+  console.log("\n=== GitHub Release ===");
+  const notesFile = join(process.env.TEMP || ".", `notes-${name}-${nextVer}.md`);
+  writeFileSync(notesFile, `## v${nextVer}\n\nRelease generated by scripts/release-plugin.mjs\n`);
+  // 必须在插件目录（git 仓库）内运行：gh release 内部会做 git 检查
+  run(`cd /d "${dir}" && ${proxyPrefix()}gh release create v${nextVer} "${join(dir, tgz)}" --title "${name} v${nextVer}" --notes-file "${notesFile}"`);
+}
+
+// ── 7. 本机 profile 同步（--sync-profile：豁免名单 + 装配审计；需 danger-full-access 运行）──
+if (syncProfile) {
+  console.log("\n=== 本机 profile 同步 ===");
+  let manifest = null;
+  try {
+    manifest = JSON.parse(readFileSync(join(SCRIPT_DIR, "plugins.json"), "utf8"));
+  } catch {
+    manifest = { profile: "web" };
+  }
+  const profileDir = resolve(WORKSPACE, "..", ".dsh", "profiles", manifest.profile || "web");
+  const wsYaml = join(profileDir, "pnpm-workspace.yaml");
+  if (existsSync(wsYaml)) {
+    const raw = readFileSync(wsYaml, "utf8");
+    const lineRe = new RegExp(`^(  - ${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}@[^\\n]*)$`, "m");
+    const m = raw.match(lineRe);
+    if (m && !m[1].includes(nextVer)) {
+      const bakDir = join(profileDir, "..", ".backups");
+      mkdirSync(bakDir, { recursive: true });
+      const stamp = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
+      const bak = join(bakDir, `pnpm-workspace-${stamp}.yaml`);
+      copyFileSync(wsYaml, bak);
+      const updated = raw.replace(lineRe, `${m[1]} || ${nextVer}`);
+      writeFileSync(wsYaml, updated);
+      console.log(`豁免名单已追加 ${name}@${nextVer}（备份 ${bak}）`);
+    } else if (!m) {
+      console.log(`（豁免名单无 ${name} 条目，跳过）`);
+    } else {
+      console.log(`（豁免名单已含 ${nextVer}，跳过）`);
+    }
+  }
+  // 全量装配审计（规则 27）
+  const auditScript = join(SCRIPT_DIR, "..", "projects", "oss", "dsh-rule-engine", "scripts", "audit-mount-consistency.mjs");
+  if (existsSync(auditScript)) {
+    const out = quiet(`node "${auditScript}" --profile ${manifest.profile || "web"}`);
+    const pass = /MOUNT CONSISTENT/.test(out);
+    console.log(out.split("\n").filter((l) => /RESULT|DUPLICATES|MOUNT|summary/.test(l)).join("\n"));
+    if (!pass) fail("装配审计未通过（MOUNT CONSISTENT 未出现），请先处理再重启 DSH");
+    console.log("装配审计 MOUNT CONSISTENT ✓");
+  }
+}
+
+console.log(`\n=== 发布完成：${name} v${nextVer} ===`);
+console.log(`npm: ${name}@${nextVer}`);
+console.log(`release: https://github.com/${repo}/releases/tag/v${nextVer}`);

package/scripts/verify-all.mjs

@@ -119,6 +119,10 @@ if (judgeReal > 0) {
   lines.push("⚠️ 真实判例：近 24h 无 judge-pass/judge-false 记录——裁决器需要一次实弹（非阻塞 WARN，但说明运行证据尚未产生）");
 }
 
+// ── ⑧ 发布适用性门禁（T6，2026-08-31：通用化"陌生人视角"硬闸）──
+// 无 AGENTS.md 冷启动 / 空白规则静默 / 任意编号规则声明式绑定 / 格式契约冒烟 / 个人标识扫描
+step("发布适用性门禁（无 AGENTS.md 冷启动 / 空白规则 / 任意编号 / 个人标识扫描）", process.execPath, [join(root, "scripts", "publish-aptitude-check.mjs")]);
+
 console.log(lines.join("\n"));
 const failed = lines.filter((l) => l.startsWith("❌"));
 if (failed.length) {