dsh-rule-engine 0.5.17 → 0.6.1

package/scripts/audit-mount-consistency.mjs

@@ -1,198 +1,198 @@
-// FULL mount-consistency audit: bundles vs user patch inserts vs bundle-internal patches vs dependencies
-// Goal: detect ANY loader entry id that would be mounted more than once (duplicate loader entry crash)
-import { readFileSync, existsSync, readdirSync } from 'node:fs'
-import { createRequire } from 'node:module'
-import { join, dirname } from 'node:path'
-
-const DSH_HOME = process.env.DSH_HOME || 'D:/DeepSeek harness/.dsh'
-const DEFAULT_PROFILE = 'web'
-function profileNameFromArgs() {
-  const argv = process.argv
-  let idx = argv.indexOf('--profile')
-  if (idx >= 0 && argv[idx + 1]) return argv[idx + 1]
-  const eq = argv.find((a) => a.startsWith('--profile='))
-  if (eq) return eq.slice('--profile='.length)
-  return DEFAULT_PROFILE
-}
-const PROFILE_NAME = profileNameFromArgs()
-const PROFILE = join(DSH_HOME, 'profiles', PROFILE_NAME)
-console.log(`Profile: ${PROFILE_NAME} -> ${PROFILE}`)
-if (!existsSync(join(PROFILE, 'package.json'))) {
-  console.error(`[ERROR] profile package.json not found: ${join(PROFILE, 'package.json')}`)
-  process.exit(2)
-}
-const profilePkg = JSON.parse(readFileSync(join(PROFILE, 'package.json'), 'utf8'))
-const requireFromProfile = createRequire(join(PROFILE, 'package.json'))
-
-/** 从 patch 文本提取 insert 块中的 loader entry id（支持块状和行内两种写法） */
-function extractInsertIds(text) {
-  const ids = []
-  const lines = String(text || '').split('\n')
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i]
-    if (!/^-\s*insert:/i.test(line)) continue
-    const rest = line.replace(/^-\s*insert:\s*/i, '')
-    if (rest.trim()) {
-      // 行内形式：- insert: { id: xxx } / - insert: - id: xxx
-      for (const m of rest.matchAll(/id:\s*["']?([^\s#"']+)/gi)) ids.push(m[1])
-      continue
-    }
-    // 块状形式：- insert: 后跟缩进的 - id: xxx
-    for (let j = i + 1; j < lines.length; j++) {
-      const l = lines[j]
-      if (/^\S/.test(l) && !/^\s/.test(l)) break // 回到顶层条目
-      const m = l.match(/^\s+- id:\s*["']?([^\s#"']+)/i)
-      if (m) ids.push(m[1])
-    }
-  }
-  return [...new Set(ids)]
-}
-
-/** 解析 bundle 包路径：优先 profile/node_modules，再 profiles/node_modules，最后用 Node 解析 */
-function resolveBundlePkg(b) {
-  const candidates = [
-    join(PROFILE, 'node_modules', b, 'package.json'),
-    join(DSH_HOME, 'profiles', 'node_modules', b, 'package.json')
-  ]
-  if (b.startsWith('@')) {
-    const [scope, name] = b.split('/')
-    candidates.push(join(DSH_HOME, 'profiles', 'node_modules', scope, name, 'package.json'))
-  }
-  for (const c of candidates) if (existsSync(c)) return c
-  try {
-    return requireFromProfile.resolve(`${b}/package.json`)
-  } catch {
-    return null
-  }
-}
-
-/** 读取一个 patch 文件并把其中的 insert id 记入 sources */
-function collectPatchInserts(patchPath, viaLabel) {
-  if (!existsSync(patchPath)) return []
-  const ids = extractInsertIds(readFileSync(patchPath, 'utf8'))
-  for (const id of ids) sources.push({ id, via: viaLabel, file: patchPath })
-  return ids
-}
-
-// ---- collect all sources of loader entry ids ----
-const sources = [] // {id, via, file}
-
-// 1. profile bundles array (each bundle's internal cordis.patch.yml inserts + the bundle row itself)
-const bundles = profilePkg.dsh?.profile?.bundles || []
-console.log('=== 1. profile bundles array (' + bundles.length + ') ===')
-for (const b of bundles) {
-  console.log('  bundle:', b)
-  const pkgPath = resolveBundlePkg(b)
-  if (!pkgPath) { console.log('    [WARN] package.json not found for ' + b); continue }
-  const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
-  const patchRel = pkg.dsh?.bundle?.patch
-  if (patchRel) {
-    const patchPath = join(dirname(pkgPath), patchRel)
-    const inserts = collectPatchInserts(patchPath, `bundle-internal patch of ${b}`)
-    if (existsSync(patchPath)) {
-      console.log(`    internal patch ${patchRel}: inserts = ${inserts.length ? inserts.join(',') : '(none)'}`)
-    } else {
-      console.log('    [WARN] bundle patch missing: ' + patchPath)
-    }
-  }
-  // the bundle package itself may be a plugin row too (via loader) — record its name as entry candidate
-  // (bundle packages themselves are not loader entries; only their patch rows are)
-}
-
-// 2. user cordis.patch.yml inserts (profile layer)
-const userPatchPath = join(PROFILE, 'cordis.patch.yml')
-const userPatch = readFileSync(userPatchPath, 'utf8')
-console.log('\n=== 2. user cordis.patch.yml (profile layer) ===')
-const userInserts = collectPatchInserts(userPatchPath, 'user patch insert')
-// also non-insert top-level entries (override/disable by id) — these do NOT create entries but list them
-const topLevelIds = [...userPatch.matchAll(/^-\s+id:\s+([^\s#]+)/gm)].map((m) => m[1])
-console.log('  user patch top-level ids:', topLevelIds.join(',') || '(none)')
-console.log('  user patch inserts:', userInserts.join(',') || '(none)')
-
-// 2.5 root user cordis.patch.yml inserts (if present)
-const rootPatchPath = join(DSH_HOME, 'cordis.patch.yml')
-const rootInserts = []
-if (existsSync(rootPatchPath)) {
-  console.log('\n=== 2.5 root user cordis.patch.yml ===')
-  rootInserts.push(...collectPatchInserts(rootPatchPath, 'root user patch insert'))
-  console.log('  root user patch inserts:', rootInserts.join(',') || '(none)')
-} else {
-  console.log('\n=== 2.5 root user cordis.patch.yml ===')
-  console.log('  (no root cordis.patch.yml)')
-}
-
-// 3. dependencies with link/github/http (local dev packages) — check their type
-console.log('\n=== 3. dependencies type check ===')
-const deps = profilePkg.dependencies || {}
-for (const [name, spec] of Object.entries(deps)) {
-  const isLocal = typeof spec === 'string' && (spec.startsWith('link:') || spec.startsWith('github:') || spec.startsWith('http') || spec.startsWith('file:'))
-  console.log(`  ${name}: ${spec} ${isLocal ? '(LOCAL/dev)' : ''}`)
-  if (isLocal) {
-    // resolve local dir and check dsh type
-    let dir = null
-    if (spec.startsWith('link:')) dir = spec.slice(5)
-    else if (spec.startsWith('file:')) dir = spec.slice(5)
-    else if (spec.startsWith('github:') || spec.startsWith('http')) dir = join(PROFILE, 'node_modules', name)
-    if (dir) {
-      const lp = join(dir.replace(/\\/g, '/'), 'package.json')
-      if (existsSync(lp)) {
-        const lpj = JSON.parse(readFileSync(lp, 'utf8'))
-        const dshType = lpj.dsh?.bundle ? 'dsh.bundle' : (lpj.dsh?.plugin ? 'dsh.plugin' : (lpj.dsh ? JSON.stringify(lpj.dsh) : 'no dsh field'))
-        const inBundles = bundles.includes(name)
-        const inUserPatch = userInserts.includes(name) || rootInserts.includes(name) || topLevelIds.includes(name)
-        console.log(`    -> type: ${dshType} | inBundles: ${inBundles} | inUserPatch: ${inUserPatch}`)
-        // rule 24: dsh.plugin must NOT be in bundles; dsh.bundle SHOULD be in bundles not in user patch insert
-        if (dshType === 'dsh.plugin' && inBundles) {
-          console.log('    [VIOLATION rule24] dsh.plugin in bundles!')
-        }
-        if (dshType === 'dsh.bundle' && inUserPatch) {
-          console.log('    [WARN] dsh.bundle also present in user patch — check duplicate')
-        }
-      }
-    }
-  }
-}
-
-// 3.5 runtime injection registry (super-injector) — also produces loader entries
-console.log('\n=== 3.5 runtime injection registry ===')
-const superInjectorRegistry = join(DSH_HOME, 'super-injector', 'registry.json')
-try {
-  if (existsSync(superInjectorRegistry)) {
-    const reg = JSON.parse(readFileSync(superInjectorRegistry, 'utf8'))
-    if (!Array.isArray(reg)) throw new Error('registry.json is not an array')
-    const names = reg.map((e) => e && e.name).filter(Boolean)
-    for (const name of names) {
-      sources.push({ id: name, via: 'runtime injection (super-injector registry)', file: superInjectorRegistry })
-    }
-    console.log('  runtime injected:', names.join(', ') || '(none)')
-  } else {
-    console.log('  (no super-injector registry found; if dev_inject_plugin has been used, run dev_injected_list to confirm)')
-  }
-} catch (e) {
-  console.log('  [WARN] failed to read super-injector registry:', e instanceof Error ? e.message : String(e))
-}
-
-// 4. duplicate detection across ALL sources
-console.log('\n=== 4. DUPLICATE LOADER ENTRY DETECTION ===')
-const byId = new Map()
-for (const s of sources) {
-  if (!byId.has(s.id)) byId.set(s.id, [])
-  byId.get(s.id).push(s)
-}
-let dupFound = false
-for (const [id, list] of byId) {
-  if (list.length > 1) {
-    dupFound = true
-    console.log(`  [DUPLICATE] id "${id}" mounted ${list.length} times:`)
-    for (const s of list) console.log(`    - via ${s.via} (${s.file})`)
-  }
-}
-if (!dupFound) console.log('  NO duplicate loader entry ids found — clean')
-
-// 5. also check bundle rows vs their internal patch first insert (self-reference is fine)
-console.log('\n=== 5. summary ===')
-console.log('  bundles:', bundles.join(', '))
-console.log('  user inserts:', userInserts.join(',') || '(none)')
-console.log('  root user inserts:', rootInserts.join(',') || '(none)')
-console.log(dupFound ? '  RESULT: DUPLICATES FOUND — MUST FIX BEFORE RESTART' : '  RESULT: MOUNT CONSISTENT — SAFE TO RESTART')
-process.exit(dupFound ? 1 : 0)
+// FULL mount-consistency audit: bundles vs user patch inserts vs bundle-internal patches vs dependencies
+// Goal: detect ANY loader entry id that would be mounted more than once (duplicate loader entry crash)
+import { readFileSync, existsSync, readdirSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { join, dirname } from 'node:path'
+
+const DSH_HOME = process.env.DSH_HOME || 'D:/example workspace/.dsh'
+const DEFAULT_PROFILE = 'web'
+function profileNameFromArgs() {
+  const argv = process.argv
+  let idx = argv.indexOf('--profile')
+  if (idx >= 0 && argv[idx + 1]) return argv[idx + 1]
+  const eq = argv.find((a) => a.startsWith('--profile='))
+  if (eq) return eq.slice('--profile='.length)
+  return DEFAULT_PROFILE
+}
+const PROFILE_NAME = profileNameFromArgs()
+const PROFILE = join(DSH_HOME, 'profiles', PROFILE_NAME)
+console.log(`Profile: ${PROFILE_NAME} -> ${PROFILE}`)
+if (!existsSync(join(PROFILE, 'package.json'))) {
+  console.error(`[ERROR] profile package.json not found: ${join(PROFILE, 'package.json')}`)
+  process.exit(2)
+}
+const profilePkg = JSON.parse(readFileSync(join(PROFILE, 'package.json'), 'utf8'))
+const requireFromProfile = createRequire(join(PROFILE, 'package.json'))
+
+/** 从 patch 文本提取 insert 块中的 loader entry id（支持块状和行内两种写法） */
+function extractInsertIds(text) {
+  const ids = []
+  const lines = String(text || '').split('\n')
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    if (!/^-\s*insert:/i.test(line)) continue
+    const rest = line.replace(/^-\s*insert:\s*/i, '')
+    if (rest.trim()) {
+      // 行内形式：- insert: { id: xxx } / - insert: - id: xxx
+      for (const m of rest.matchAll(/id:\s*["']?([^\s#"']+)/gi)) ids.push(m[1])
+      continue
+    }
+    // 块状形式：- insert: 后跟缩进的 - id: xxx
+    for (let j = i + 1; j < lines.length; j++) {
+      const l = lines[j]
+      if (/^\S/.test(l) && !/^\s/.test(l)) break // 回到顶层条目
+      const m = l.match(/^\s+- id:\s*["']?([^\s#"']+)/i)
+      if (m) ids.push(m[1])
+    }
+  }
+  return [...new Set(ids)]
+}
+
+/** 解析 bundle 包路径：优先 profile/node_modules，再 profiles/node_modules，最后用 Node 解析 */
+function resolveBundlePkg(b) {
+  const candidates = [
+    join(PROFILE, 'node_modules', b, 'package.json'),
+    join(DSH_HOME, 'profiles', 'node_modules', b, 'package.json')
+  ]
+  if (b.startsWith('@')) {
+    const [scope, name] = b.split('/')
+    candidates.push(join(DSH_HOME, 'profiles', 'node_modules', scope, name, 'package.json'))
+  }
+  for (const c of candidates) if (existsSync(c)) return c
+  try {
+    return requireFromProfile.resolve(`${b}/package.json`)
+  } catch {
+    return null
+  }
+}
+
+/** 读取一个 patch 文件并把其中的 insert id 记入 sources */
+function collectPatchInserts(patchPath, viaLabel) {
+  if (!existsSync(patchPath)) return []
+  const ids = extractInsertIds(readFileSync(patchPath, 'utf8'))
+  for (const id of ids) sources.push({ id, via: viaLabel, file: patchPath })
+  return ids
+}
+
+// ---- collect all sources of loader entry ids ----
+const sources = [] // {id, via, file}
+
+// 1. profile bundles array (each bundle's internal cordis.patch.yml inserts + the bundle row itself)
+const bundles = profilePkg.dsh?.profile?.bundles || []
+console.log('=== 1. profile bundles array (' + bundles.length + ') ===')
+for (const b of bundles) {
+  console.log('  bundle:', b)
+  const pkgPath = resolveBundlePkg(b)
+  if (!pkgPath) { console.log('    [WARN] package.json not found for ' + b); continue }
+  const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+  const patchRel = pkg.dsh?.bundle?.patch
+  if (patchRel) {
+    const patchPath = join(dirname(pkgPath), patchRel)
+    const inserts = collectPatchInserts(patchPath, `bundle-internal patch of ${b}`)
+    if (existsSync(patchPath)) {
+      console.log(`    internal patch ${patchRel}: inserts = ${inserts.length ? inserts.join(',') : '(none)'}`)
+    } else {
+      console.log('    [WARN] bundle patch missing: ' + patchPath)
+    }
+  }
+  // the bundle package itself may be a plugin row too (via loader) — record its name as entry candidate
+  // (bundle packages themselves are not loader entries; only their patch rows are)
+}
+
+// 2. user cordis.patch.yml inserts (profile layer)
+const userPatchPath = join(PROFILE, 'cordis.patch.yml')
+const userPatch = readFileSync(userPatchPath, 'utf8')
+console.log('\n=== 2. user cordis.patch.yml (profile layer) ===')
+const userInserts = collectPatchInserts(userPatchPath, 'user patch insert')
+// also non-insert top-level entries (override/disable by id) — these do NOT create entries but list them
+const topLevelIds = [...userPatch.matchAll(/^-\s+id:\s+([^\s#]+)/gm)].map((m) => m[1])
+console.log('  user patch top-level ids:', topLevelIds.join(',') || '(none)')
+console.log('  user patch inserts:', userInserts.join(',') || '(none)')
+
+// 2.5 root user cordis.patch.yml inserts (if present)
+const rootPatchPath = join(DSH_HOME, 'cordis.patch.yml')
+const rootInserts = []
+if (existsSync(rootPatchPath)) {
+  console.log('\n=== 2.5 root user cordis.patch.yml ===')
+  rootInserts.push(...collectPatchInserts(rootPatchPath, 'root user patch insert'))
+  console.log('  root user patch inserts:', rootInserts.join(',') || '(none)')
+} else {
+  console.log('\n=== 2.5 root user cordis.patch.yml ===')
+  console.log('  (no root cordis.patch.yml)')
+}
+
+// 3. dependencies with link/github/http (local dev packages) — check their type
+console.log('\n=== 3. dependencies type check ===')
+const deps = profilePkg.dependencies || {}
+for (const [name, spec] of Object.entries(deps)) {
+  const isLocal = typeof spec === 'string' && (spec.startsWith('link:') || spec.startsWith('github:') || spec.startsWith('http') || spec.startsWith('file:'))
+  console.log(`  ${name}: ${spec} ${isLocal ? '(LOCAL/dev)' : ''}`)
+  if (isLocal) {
+    // resolve local dir and check dsh type
+    let dir = null
+    if (spec.startsWith('link:')) dir = spec.slice(5)
+    else if (spec.startsWith('file:')) dir = spec.slice(5)
+    else if (spec.startsWith('github:') || spec.startsWith('http')) dir = join(PROFILE, 'node_modules', name)
+    if (dir) {
+      const lp = join(dir.replace(/\\/g, '/'), 'package.json')
+      if (existsSync(lp)) {
+        const lpj = JSON.parse(readFileSync(lp, 'utf8'))
+        const dshType = lpj.dsh?.bundle ? 'dsh.bundle' : (lpj.dsh?.plugin ? 'dsh.plugin' : (lpj.dsh ? JSON.stringify(lpj.dsh) : 'no dsh field'))
+        const inBundles = bundles.includes(name)
+        const inUserPatch = userInserts.includes(name) || rootInserts.includes(name) || topLevelIds.includes(name)
+        console.log(`    -> type: ${dshType} | inBundles: ${inBundles} | inUserPatch: ${inUserPatch}`)
+        // rule 24: dsh.plugin must NOT be in bundles; dsh.bundle SHOULD be in bundles not in user patch insert
+        if (dshType === 'dsh.plugin' && inBundles) {
+          console.log('    [VIOLATION rule24] dsh.plugin in bundles!')
+        }
+        if (dshType === 'dsh.bundle' && inUserPatch) {
+          console.log('    [WARN] dsh.bundle also present in user patch — check duplicate')
+        }
+      }
+    }
+  }
+}
+
+// 3.5 runtime injection registry (example-injector) — also produces loader entries
+console.log('\n=== 3.5 runtime injection registry ===')
+const superInjectorRegistry = join(DSH_HOME, 'example-injector', 'registry.json')
+try {
+  if (existsSync(superInjectorRegistry)) {
+    const reg = JSON.parse(readFileSync(superInjectorRegistry, 'utf8'))
+    if (!Array.isArray(reg)) throw new Error('registry.json is not an array')
+    const names = reg.map((e) => e && e.name).filter(Boolean)
+    for (const name of names) {
+      sources.push({ id: name, via: 'runtime injection (example-injector registry)', file: superInjectorRegistry })
+    }
+    console.log('  runtime injected:', names.join(', ') || '(none)')
+  } else {
+    console.log('  (no example-injector registry found; if dev_inject_plugin has been used, run dev_injected_list to confirm)')
+  }
+} catch (e) {
+  console.log('  [WARN] failed to read example-injector registry:', e instanceof Error ? e.message : String(e))
+}
+
+// 4. duplicate detection across ALL sources
+console.log('\n=== 4. DUPLICATE LOADER ENTRY DETECTION ===')
+const byId = new Map()
+for (const s of sources) {
+  if (!byId.has(s.id)) byId.set(s.id, [])
+  byId.get(s.id).push(s)
+}
+let dupFound = false
+for (const [id, list] of byId) {
+  if (list.length > 1) {
+    dupFound = true
+    console.log(`  [DUPLICATE] id "${id}" mounted ${list.length} times:`)
+    for (const s of list) console.log(`    - via ${s.via} (${s.file})`)
+  }
+}
+if (!dupFound) console.log('  NO duplicate loader entry ids found — clean')
+
+// 5. also check bundle rows vs their internal patch first insert (self-reference is fine)
+console.log('\n=== 5. summary ===')
+console.log('  bundles:', bundles.join(', '))
+console.log('  user inserts:', userInserts.join(',') || '(none)')
+console.log('  root user inserts:', rootInserts.join(',') || '(none)')
+console.log(dupFound ? '  RESULT: DUPLICATES FOUND — MUST FIX BEFORE RESTART' : '  RESULT: MOUNT CONSISTENT — SAFE TO RESTART')
+process.exit(dupFound ? 1 : 0)

package/scripts/check-tool-coverage.mjs

@@ -1,41 +1,63 @@
-// check-tool-coverage.mjs — 0.5.9 工具覆盖门禁（K-01/K-06 依据，仿官方 verify-tool-catalog）：
-// 官方 tool-catalog（生成器产物=权威全集）中的每个工具名都必须在分类表/前缀规则内被识别，
-// 任何一个 unknown = 该工具调用会被未知工具首调处置（ask/deny）→ 工程失败。
-// 用法：node scripts/check-tool-coverage.mjs
-import { readFileSync } from "node:fs";
-import { toolClass } from "../lib/core/tool-catalog.js";
-
-const CATALOG = "D:\\DeepSeek harness\\dsh-project\\docs-site-text\\en\\reference\\tool-catalog.txt";
-
-function parseNames() {
-  const names = new Set();
-  for (const line of readFileSync(CATALOG, "utf8").split("\n")) {
-    if (!line.includes("@deepseek-ai/dsh-")) continue;
-    const cols = line.split("|").map((c) => c.trim());
-    // 表列格式：| | <package> | <model-visible names> | <requires> | <writes> | <shipped aliases> | <note> |
-    if (!cols[2] || !cols[2].startsWith("@deepseek-ai")) continue;
-    const add = (s) => {
-      if (!s || s === "-") return;
-      for (const x of s.split(",")) {
-        const n = x.trim();
-        if (/^[A-Za-z_][A-Za-z0-9_:.-]*$/.test(n)) names.add(n);
-      }
-    };
-    add(cols[3]);
-    add(cols[6]);
-  }
-  return names;
-}
-
-const official = parseNames();
-const missing = [];
-for (const n of official) {
-  if (toolClass(n, {}) === "unknown") missing.push(n);
-}
-
-if (missing.length) {
-  console.error(`COVERAGE-FAIL：官方 tool-catalog 有 ${missing.length} 个工具未分类（会被未知工具首调处置）：`);
-  for (const n of missing) console.error("  - " + n);
-  process.exit(1);
-}
-console.log(`COVERAGE-OK：官方 tool-catalog 工具全覆盖（${official.size} 个工具名均被分类表/前缀规则识别）`);
+// check-tool-coverage.mjs — 0.5.9 工具覆盖门禁（K-01/K-06 依据，仿官方 verify-tool-catalog）：
+// 官方 tool-catalog（生成器产物=权威全集）中的每个工具名都必须在分类表/前缀规则内被识别，
+// 任何一个 unknown = 该工具调用会被未知工具首调处置（ask/deny）→ 工程失败。
+// 0.6.0（02 B2′ 裁决 v1.4，2026-09-04 第三方裁示+用户确认）：
+//   - 素材来源优先级：--catalog <path> → CHECK_TOOL_CATALOG 环境变量 → 均缺 = FAIL（诊断含获取方式，禁 ENOENT 死路径）；
+//   - --skip-catalog 显式出口：输出 WARNING 并计入汇总（发布流水线永远不传该参数）；
+//   - 素材版本须与本机 DSH 版本对齐（不一致 WARNING 不 FAIL）；
+//   - 校验逻辑与判据不变（官方全集 ⊆ 分类表，任一 unknown 即红）。
+// 用法：node scripts/check-tool-coverage.mjs [--catalog <path>] [--skip-catalog]
+import { readFileSync } from "node:fs";
+import { toolClass } from "../lib/core/tool-catalog.js";
+
+function argVal(name) {
+  const i = process.argv.indexOf(name);
+  return i !== -1 && process.argv[i + 1] ? process.argv[i + 1] : null;
+}
+const SKIP_CATALOG = process.argv.includes("--skip-catalog");
+const CATALOG = argVal("--catalog") || process.env.CHECK_TOOL_CATALOG || null;
+
+if (!CATALOG) {
+  if (SKIP_CATALOG) {
+    console.warn("WARNING：--skip-catalog 已传——工具箱覆盖层跳过（素材缺失；发布流水线禁止此参数）");
+    process.exit(0);
+  }
+  console.error("TOOL-CATALOG-MISSING：未指定官方 tool-catalog.txt——请用 --catalog <path> 或环境变量 CHECK_TOOL_CATALOG 指定（官方文档产物可从 DSH 官方文档仓库 docs-site-text 获取）；FAIL，禁止静默跳过");
+  if (process.env.LOCAL_CATALOG_HINT) {
+    console.error(`（本机提示：${process.env.LOCAL_CATALOG_HINT}）`);
+  }
+  process.exit(1);
+}
+
+function parseNames() {
+  const names = new Set();
+  for (const line of readFileSync(CATALOG, "utf8").split("\n")) {
+    if (!line.includes("@deepseek-ai/dsh-")) continue;
+    const cols = line.split("|").map((c) => c.trim());
+    // 表列格式：| | <package> | <model-visible names> | <requires> | <writes> | <shipped aliases> | <note> |
+    if (!cols[2] || !cols[2].startsWith("@deepseek-ai")) continue;
+    const add = (s) => {
+      if (!s || s === "-") return;
+      for (const x of s.split(",")) {
+        const n = x.trim();
+        if (/^[A-Za-z_][A-Za-z0-9_:.-]*$/.test(n)) names.add(n);
+      }
+    };
+    add(cols[3]);
+    add(cols[6]);
+  }
+  return names;
+}
+
+const official = parseNames();
+const missing = [];
+for (const n of official) {
+  if (toolClass(n, {}) === "unknown") missing.push(n);
+}
+
+if (missing.length) {
+  console.error(`COVERAGE-FAIL：官方 tool-catalog 有 ${missing.length} 个工具未分类（会被未知工具首调处置）：`);
+  for (const n of missing) console.error("  - " + n);
+  process.exit(1);
+}
+console.log(`COVERAGE-OK：官方 tool-catalog 工具全覆盖（${official.size} 个工具名均被分类表/前缀规则识别）`);

package/scripts/lib/pnpm-exempt.mjs

@@ -0,0 +1,56 @@
+// pnpm-exempt.mjs — pnpm-workspace minimumReleaseAgeExclude 豁免判定（verify-all ⑬ 与 release-plugin 预插共享单源）
+// 约定（exempt 语义）：行含包名（`pkg@`）且版本段任一匹配——yaml 支持 `- pkg@1.5.3 || 1.5.4` 形态（段可带/不带包名前缀）
+import { readFileSync, writeFileSync } from "node:fs";
+
+export function exemptPkg(wsYaml, pkg, ver) {
+  if (typeof wsYaml !== "string" || wsYaml.length === 0) return false;
+  return wsYaml.split(/\r?\n/).some((l) => l.includes(`${pkg}@`) && l.split(/\s*\|\|\s*/).some((tok) => {
+    const t = tok.trim().replace(/^-\s*/, "");
+    return t === ver || t === `${pkg}@${ver}`;
+  }));
+}
+
+/** 追加豁免行（已存在=幂等跳过；返回 {yaml, added}） */
+export function addExemptLine(wsYaml, pkg, ver) {
+  if (exemptPkg(wsYaml, pkg, ver)) return { yaml: wsYaml, added: false };
+  const sep = wsYaml.endsWith("\n") ? "" : "\n";
+  return { yaml: `${wsYaml}${sep}  - ${pkg}@${ver}\n`, added: true };
+}
+
+/** 读 yaml（fail-closed：读取失败抛错，调用方中止发布） */
+export function readYamlOrThrow(path) {
+  try {
+    const text = readFileSync(path, "utf8");
+    if (!text.includes("minimumReleaseAgeExclude")) throw new Error(`yaml 缺 minimumReleaseAgeExclude 块：${path}`);
+    return text;
+  } catch (e) {
+    if (e.code === "ENOENT") throw new Error(`yaml 不存在（fail-closed）：${path}`);
+    throw e;
+  }
+}
+
+/**
+ * 预插核心（release-plugin bump 后 publish 前调用；单测可注入 dryRun/write/log）：
+ * 已存在=幂等跳过；yaml 缺失/坏=抛错（fail-closed）；dryRun=只打印不写。
+ */
+export function ensureExempt(yamlPath, pkgName, ver, opts = {}) {
+  const { dryRun = false, write = (p, c) => writeFileSync(p, c, "utf8"), log = console.log } = opts;
+  let yaml;
+  try {
+    yaml = readYamlOrThrow(yamlPath);
+  } catch (e) {
+    throw new Error(`豁免预插失败（fail-closed 中止）：${e.message}`);
+  }
+  const { yaml: nextYaml, added } = addExemptLine(yaml, pkgName, ver);
+  if (dryRun) {
+    log(`[DRY-RUN] 豁免预插：${added ? `将追加 ${pkgName}@${ver}` : `已存在（幂等跳过）`}`);
+    return { added, dryRun: true };
+  }
+  if (added) {
+    write(yamlPath, nextYaml);
+    log(`豁免预插：+ ${pkgName}@${ver}`);
+  } else {
+    log(`豁免预插：${pkgName}@${ver} 已存在（幂等跳过）`);
+  }
+  return { added };
+}

package/scripts/local-residue-scan.mjs

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+// local-residue-scan.mjs — 发布物本机痕迹扫描（仅扫 lib/；无 --pack 模式）
+// 用法：node scripts/local-residue-scan.mjs   （在包根目录运行；exit 0 = 干净，exit 1 = 有命中）
+
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join, extname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { dirname } from "node:path";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+// 词表唯一源（v1.2）：scripts/local-residue-markers.txt，与阶段 A 的 A6 验收共用同一文件。
+const MARKERS = readFileSync(join(root, "scripts", "local-residue-markers.txt"), "utf8")
+  .split("\n").map((s) => s.trim()).filter((s) => s && !s.startsWith("#"));
+// 注意：不扫 package.json（作者署名/仓库地址为合法项，A6 口径见其节）；tool-catalog.js 的
+// dev_/esr_/engram_ 前缀规则按阶段 A「关键裁决 3」保留，静态枚举列 0.6.x 跟进。
+
+const TEXT_EXT = new Set([".js", ".mjs", ".cjs", ".json", ".md", ".yml", ".yaml"]);
+function* walk(dir) {
+  for (const e of readdirSync(dir)) {
+    const p = join(dir, e);
+    const s = statSync(p);
+    if (s.isDirectory()) { if (e !== "node_modules" && e !== ".git") yield* walk(p); }
+    else if (TEXT_EXT.has(extname(e))) yield p;
+  }
+}
+
+let hits = 0;
+for (const file of walk(join(root, "lib"))) {
+  const text = readFileSync(file, "utf8");
+  for (const m of MARKERS) {
+    const lines = text.split("\n");
+    lines.forEach((line, i) => {
+      if (line.includes(m)) { console.log(`HIT  ${file}:${i + 1}  [${m}]  ${line.trim()}`); hits++; }
+    });
+  }
+}
+
+if (hits) { console.error(`\nRESIDUE SCAN FAILED（${hits} 处本机痕迹）`); process.exit(1); }
+console.log("RESIDUE SCAN OK（发布面零本机痕迹）");