iterate-plugin 3.4.0 → 3.4.1

package/README.md

@@ -292,9 +292,20 @@ All runtime state lives under `.iterate/` at the project root (can be excluded v
 
 - **Node.js**: `>=20` (`package.json` `engines.node`).
 - **DSH**: declares `dsh.compatibility.dshReleases` — `compatible` for the official
-  `0.1.2-alpha.4`, `0.1.2-alpha.5`, and `0.1.2-rc.1` releases. The plugin is built
-  against `@deepseek-ai/dsh-tools` / `@deepseek-ai/dsh-util-values` `0.1.2-rc.1`
-  and uses only public contracts (tool registration, client slots + theme, bundle patch).
+  `0.1.1-rc.1`, `0.1.2-alpha.4`, `0.1.2-alpha.5`, `0.1.2-rc.1`, and `0.1.3-alpha.1`
+  releases. The plugin is built against `@deepseek-ai/dsh-tools` /
+  `@deepseek-ai/dsh-util-values` `0.1.2-rc.1` and uses only public contracts
+  (tool registration, client slots + theme, bundle patch). `0.1.3-alpha.1` is a
+  source declaration matching the current DSH release window; it does not use any
+  API changed by that release.
+- **Disposable-Profile evidence (real, `dsh` CLI `0.1.1-rc.1`)**: on a temp
+  `$DSH_HOME`, `dsh plugin --profile <p> add <this-repo>` installed the bundle in
+  ~449 ms; `dsh --profile <p> --dump-config` composed the `iterate-plugin` bundle
+  patch into the profile; `dsh plugin --profile <p> remove iterate-plugin`
+  uninstalled in ~602 ms and left zero references in the composed config. A full
+  runtime boot was **not** exercised here (no model provider in the disposable
+  profile), so `dshOperations` start/rollback stay `unknown`/`partial` — see
+  `CHANGELOG.md` for the exact commands and timings.
 
 ### Runtime permissions (conservative disclosure)
 
@@ -308,10 +319,14 @@ following capabilities; elevated capability means a DSH Profile install stays
   in-place edits to the user's source files (path-traversal protected to the
   resolved project root, backups taken before every fix, rollback on failure).
   The client half persists triage verdicts to `localStorage`.
-- **Commands** — the plugin registers model-facing tools; any shell execution that
-  the model performs (build / test / `git`) is run by the **host**, not by this
-  plugin. The client "command buttons" only copy paste-able instruction text; they
-  do not spawn processes.
+- **Commands** — the plugin's own tools execute a small, strictly bounded command
+  surface inside the dsh host process, only when the model calls them: `iterate_validate`
+  runs one of the **exact-match whitelisted** commands configured in
+  `iterate.config.yaml` `validation.commands` (yes, it shells out via
+  `node:child_process`, timeout-capped to ≤600 s); `iterate_review` (changed-only
+  scope) runs `git diff --name-only -z <branch>` in the project root. Nothing else
+  spawns a process. The client "command buttons" only copy paste-able instruction
+  text; they do not spawn processes.
 - **Credentials** — this plugin does **not** read or transmit credentials at
   runtime. The sibling **iterate-skill / iterate-harness** components may read git
   credentials / GitHub tokens when the user runs their own Git/API operations; those

package/README.zh-CN.md

@@ -290,10 +290,17 @@ validation:
 ### Node.js / DSH 兼容范围
 
 - **Node.js**：`>=20`（`package.json` 的 `engines.node`）。
-- **DSH**：在 `dsh.compatibility.dshReleases` 中声明官方 `0.1.2-alpha.4`、
-  `0.1.2-alpha.5`、`0.1.2-rc.1` 三个版本为 `compatible`。插件基于
-  `@deepseek-ai/dsh-tools` / `@deepseek-ai/dsh-util-values` `0.1.2-rc.1` 构建，
-  只使用公开契约（工具注册、客户端 slots + theme、bundle patch）。
+- **DSH**：在 `dsh.compatibility.dshReleases` 中声明官方 `0.1.1-rc.1`、
+  `0.1.2-alpha.4`、`0.1.2-alpha.5`、`0.1.2-rc.1`、`0.1.3-alpha.1` 五个版本为
+  `compatible`。插件基于 `@deepseek-ai/dsh-tools` / `@deepseek-ai/dsh-util-values`
+  `0.1.2-rc.1` 构建，只使用公开契约（工具注册、客户端 slots + theme、bundle patch）；
+  `0.1.3-alpha.1` 为匹配当前 DSH 发布窗口的源码声明，插件不使用该发布变更的任何 API。
+- **一次性 Profile 证据（真实，`dsh` CLI `0.1.1-rc.1`）**：在临时 `$DSH_HOME` 下
+  `dsh plugin --profile <p> add <本仓库>` 约 449ms 完成安装；`dsh --profile <p>
+  --dump-config` 正确合成 `iterate-plugin` bundle patch；`dsh plugin --profile <p>
+  remove iterate-plugin` 约 602ms 卸载完成、合成配置中不存在残留引用。完整运行时
+  启动未在此环境演练（一次性 Profile 无模型提供方），故 `dshOperations` 的
+  start/rollback 证据为 `unknown`/`partial`——确切命令与耗时见 `CHANGELOG.md`。
 
 ### 运行时权限（保守披露）
 
@@ -304,9 +311,12 @@ validation:
   检查点、transcript、修复备份/注册表、质量门禁、经验银行、防御事件）。
   `iterate_fix` / `iterate_triage` 还会就地修改用户源码（路径遍历防护限定在解析后
   的项目根目录内，每次修复前备份、失败回滚）。客户端侧把分诊判定持久化到 `localStorage`。
-- **命令（commands）** — 插件只注册模型可调用工具；模型要执行的任何 shell 操作
-  （build / test / `git`）都由**宿主**执行，不是本插件。客户端"指挥按钮"只复制可粘贴
-  的指令文本，不启动任何进程。
+- **命令（commands）** — 插件的工具本身只执行一个严格受限的命令面、且仅在模型调用时
+  于 dsh 宿主进程内运行：`iterate_validate` 运行 `iterate.config.yaml`
+  `validation.commands` 中**逐条精确匹配白名单**的命令（是的，经由
+  `node:child_process` 执行，超时上限 600 秒）；`iterate_review`（changed-only 范围）
+  在项目根目录运行 `git diff --name-only -z <branch>`。除此之外不启动任何进程。
+  客户端"指挥按钮"只复制可粘贴的指令文本，不启动任何进程。
 - **凭据（credentials）** — 本插件运行时**不**读取或传输凭据。同生态的
   **iterate-skill / iterate-harness** 组件在用户自行执行 Git/API 操作时可能读取
   git 凭据 / GitHub token；它们是独立包，本插件从不加载它们。

package/dist/git-scope.js

@@ -22,7 +22,7 @@
  */
 import { execFile } from 'node:child_process';
 import { existsSync, statSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, sep } from 'node:path';
 /**
  * Parse `git diff --name-only -z` stdout into a list of relative paths.
  * Pure. NUL-delimited mode is machine-safe (handles any filename); when no
@@ -112,11 +112,12 @@ export function parseChangedFiles(stdout) {
  */
 export function filterExistingFiles(root, files) {
     const out = [];
+    const rootPrefix = root.endsWith(sep) ? root : root + sep;
     for (const rel of files) {
         if (rel.startsWith('/') || rel.includes('\0'))
             continue;
         const candidate = join(root, rel);
-        if (!candidate.startsWith(root + '/') && candidate !== root)
+        if (!candidate.startsWith(rootPrefix) && candidate !== root)
             continue;
         try {
             if (existsSync(candidate) && statSync(candidate).isFile())

package/dist/skill-prompt.js

@@ -142,9 +142,20 @@ for (let r = 1; r <= maxRounds; r++) {
   // Feed the DEDUPED + already-filtered set back (not raw findings) so the known
   // list stays bounded and reviewers never see the same issue twice.
   if (agg && agg.report && Array.isArray(agg.report.findings)) known = agg.report.findings
-  if (agg && agg.report && agg.report.convergence && agg.report.convergence.findingsByRound[r-1] === 0) {
-    log('round ' + r + ' found 0 new findings — converged')
-    break
+  // A round counts as "converged" ONLY when the aggregate accepted it
+  // (schema-valid) AND it genuinely found zero NEW findings. If reviewers all
+  // failed or their output stayed schema-invalid after retries, the round is
+  // INCONCLUSIVE — never report an empty-but-broken round as converged (an
+  // invalid/failed round must fail the run, not masquerade as a clean pass).
+  if (!schemaInvalid) {
+    const newCount =
+      agg && agg.report && agg.report.convergence
+        ? agg.report.convergence.findingsByRound[r - 1]
+        : thisRound.findings.length
+    if (newCount === 0) {
+      log('round ' + r + ' found 0 new findings — converged')
+      break
+    }
   }
 }
 
@@ -237,7 +248,7 @@ if (checkpoint) {
 
 phase('plan')
 const configRes = await agent(
-  'Call iterate_config({ validate: true }) and return the config JSON.',
+  'Call iterate_config({}) and return the config JSON.',
   Object.assign({ label: 'config:read' }, backend)
 )
 const cfg = (configRes && configRes.config) ? configRes.config : null
@@ -420,7 +431,7 @@ for (let r = startRound; r <= maxRounds; r++) {
     Object.assign({ label: 'checkpoint:save:r' + r }, backend)
   )
 
-  if (atomic.length === 0 && remaining.length === 0) {
+  if (atomic.length === 0 && remaining.length === 0 && !schemaInvalid) {
     log('round ' + r + ' found nothing to fix — converged')
     converged = true
     break

package/lib/client.js

@@ -115,10 +115,11 @@ function scanSessionForResume(obj, seen, maxDepth = 20) {
 function countSessionImages(session) {
   if (!session || typeof session !== "object") return 0;
   const ids = /* @__PURE__ */ new Set();
+  const consumed = /* @__PURE__ */ new Set();
   let count = 0;
   const walk = (obj, depth) => {
     if (depth <= 0 || !obj || typeof obj !== "object") return;
-    if (seen.has(obj)) return;
+    if (seen.has(obj) || consumed.has(obj)) return;
     seen.add(obj);
     const o = (
       /** @type {Record<string, unknown>} */
@@ -142,6 +143,7 @@ function countSessionImages(session) {
       } else {
         count += 1;
       }
+      consumed.add(ref);
     }
     if (Array.isArray(obj)) {
       for (const item of obj) walk(item, depth - 1);
@@ -289,16 +291,21 @@ function attachLive(manifest, source) {
   copy.live = live;
   return copy;
 }
-function extractTranscript(obj) {
+function extractTranscript(obj, seen, depth) {
+  if (depth === void 0) depth = 0;
+  if (depth > 20) return null;
   if (typeof obj === "string") {
     try {
       const parsed = JSON.parse(obj);
-      return extractTranscript(parsed);
+      return extractTranscript(parsed, seen, depth + 1);
     } catch {
       return null;
     }
   }
   if (!obj || typeof obj !== "object") return null;
+  if (!seen) seen = /* @__PURE__ */ new Set();
+  if (seen.has(obj)) return null;
+  seen.add(obj);
   if (isTranscriptManifest(obj)) return (
     /** @type {Record<string, unknown>} */
     obj
@@ -322,11 +329,11 @@ function extractTranscript(obj) {
     if (val !== void 0) {
       if (Array.isArray(val)) {
         for (const item of val) {
-          const found = extractTranscript(item);
+          const found = extractTranscript(item, seen, depth + 1);
           if (found) return attachLive(found, o);
         }
       } else {
-        const found = extractTranscript(val);
+        const found = extractTranscript(val, seen, depth + 1);
         if (found) return attachLive(found, o);
       }
     }
@@ -569,6 +576,24 @@ function latestToolResultNode(session, toolName) {
       /** @type {Array<Record<string, unknown>>} */
       messages
     );
+    for (let i = msgs.length - 1; i >= 0; i--) {
+      const msg = msgs[i];
+      if (!msg) continue;
+      const calls = safeGet(msg, "tool_calls");
+      if (!Array.isArray(calls)) continue;
+      const callList = (
+        /** @type {Array<Record<string, unknown>>} */
+        calls
+      );
+      for (let j = callList.length - 1; j >= 0; j--) {
+        const call = callList[j];
+        if (!call) continue;
+        const name2 = String(safeGet(call, "name") ?? safeGet(call, "tool") ?? "");
+        if (name2 !== toolName && !name2.endsWith(toolName)) continue;
+        const result = safeGet(call, "result") ?? safeGet(call, "response") ?? safeGet(call, "message");
+        if (result !== void 0 && result !== null) return result;
+      }
+    }
     for (let i = msgs.length - 1; i >= 0; i--) {
       const msg = msgs[i];
       if (!msg) continue;
@@ -895,6 +920,7 @@ function computeSummaryFromFindings(findings) {
   const counts = { critical: 0, high: 0, medium: 0, low: 0 };
   const byDimension = {};
   for (const f of findings) {
+    if (!f || typeof f !== "object") continue;
     const sev = String(f.severity ?? "low");
     if (sev in counts) counts[sev]++;
     const dim = String(f.dimension ?? "unknown");
@@ -942,6 +968,7 @@ function severityStats(report) {
   );
   const counts = { critical: 0, high: 0, medium: 0, low: 0 };
   for (const f of findings) {
+    if (!f || typeof f !== "object") continue;
     const sev = String(f.severity ?? "low");
     if (sev in counts) counts[sev]++;
   }
@@ -954,6 +981,7 @@ function groupByDimension(report) {
   );
   const groups = {};
   for (const f of findings) {
+    if (!f || typeof f !== "object") continue;
     const dim = String(f.dimension ?? "unknown");
     if (!groups[dim]) groups[dim] = [];
     groups[dim].push(f);
@@ -1048,6 +1076,7 @@ function normalizeFindingFilter(filter) {
   return { severities, dimensions, search };
 }
 function findingMatches(finding, filter) {
+  if (!finding || typeof finding !== "object") return false;
   const f = normalizeFindingFilter(filter);
   const sev = String(finding.severity ?? "low");
   if (f.severities.length > 0 && !f.severities.includes(sev)) return false;
@@ -1118,6 +1147,7 @@ function setAllVerdicts(triageState, verdict, indices) {
 function buildRoundHistory(report) {
   const rounds = Array.isArray(report.rounds) ? report.rounds : [];
   return rounds.map((r) => {
+    if (!r || typeof r !== "object") return { round: 0, count: 0, critical: 0, high: 0, medium: 0, low: 0 };
     const rr = (
       /** @type {Record<string, unknown>} */
       r
@@ -1274,7 +1304,13 @@ function filterTimelineEntries(entries, opts) {
     if (type && String(t.type ?? "") !== type) return false;
     if (round && String(t.round ?? "") !== round) return false;
     if (q) {
-      const hay = [String(t.type ?? ""), String(t.round ?? ""), JSON.stringify(t.data ?? {})].join(" ").toLowerCase();
+      let dataText = "";
+      try {
+        dataText = JSON.stringify(t.data ?? {});
+      } catch {
+        dataText = t.data === void 0 ? "{}" : String(t.data);
+      }
+      const hay = [String(t.type ?? ""), String(t.round ?? ""), dataText].join(" ").toLowerCase();
       if (hay.indexOf(q) < 0) return false;
     }
     return true;
@@ -2078,7 +2114,7 @@ function TriagePanel(props) {
   const ignoredCount = ignored.length;
   const counts = countVerdicts(verdicts);
   const doApproveArchitecturalFix = () => {
-    const cmd = "\u8BF7\u8C03\u7528 `iterate_fix` \u6279\u51C6\u67B6\u6784\u4FEE\u590D\uFF08\u8BBE\u7F6E is_architectural: true\uFF09";
+    const cmd = "\u8BF7\u8C03\u7528 `iterate_fix`\uFF0C\u5BF9\u672C\u9879\u76EE\u5269\u4F59\u67B6\u6784\u578B finding \u751F\u6210\u4FEE\u590D\u5185\u5BB9\u5E76\u8BBE\u7F6E force: true \u5E94\u7528\uFF08\u67B6\u6784\u4FEE\u590D\u5141\u8BB8\u8D85\u8FC7 atomic \u9608\u503C\uFF09";
     copyText(cmd).then((ok) => {
       if (ok) {
         setCmdCopied("approve-arch");
@@ -2096,7 +2132,7 @@ function TriagePanel(props) {
     });
   };
   const doRollbackToCheckpoint = () => {
-    const cmd = "\u8BF7\u8C03\u7528 `iterate_checkpoint` \u56DE\u6EDA\u5230\u4E0A\u4E00\u4E2A\u68C0\u67E5\u70B9";
+    const cmd = "\u8BF7\u56DE\u6EDA\u4E0A\u4E00\u8F6E\u8FED\u4EE3\u7684\u4FEE\u590D\uFF1A\u8C03\u7528 `iterate_history` \u67E5\u770B\u672C\u8F6E fix id\uFF0C\u518D\u7528 `iterate_rollback` \u9010\u4E2A\u64A4\u9500\u8FD9\u4E9B\u4FEE\u590D";
     copyText(cmd).then((ok) => {
       if (ok) {
         setCmdCopied("rollback");
@@ -3180,7 +3216,14 @@ ${JSON.stringify({ operation: "nudge", text: null }, null, 2)}
     const sorted = filtered.slice();
     const rows = sorted.map((t, i) => {
       const k = `f7-${i}`;
-      const dataText = t.data && typeof t.data === "object" ? JSON.stringify(t.data) : "";
+      let dataText = "";
+      if (t.data && typeof t.data === "object") {
+        try {
+          dataText = JSON.stringify(t.data);
+        } catch {
+          dataText = String(t.data);
+        }
+      }
       return React.createElement(
         "div",
         { key: k, className: "iterate-obs-row", style: { flexDirection: "column", alignItems: "flex-start" } },

package/lib/parse.js

@@ -133,12 +133,13 @@ export function countSessionImages(session) {
   if (!session || typeof session !== 'object') return 0
 
   const ids = new Set()
+  const consumed = new Set()
   let count = 0
 
   /** @param {unknown} obj */
   const walk = (obj, depth) => {
     if (depth <= 0 || !obj || typeof obj !== 'object') return
-    if (seen.has(obj)) return
+    if (seen.has(obj) || consumed.has(obj)) return
     seen.add(obj)
     const o = /** @type {Record<string, unknown>} */ (obj)
 
@@ -158,6 +159,9 @@ export function countSessionImages(session) {
       } else {
         count += 1
       }
+      // The ref node is already counted; mark it consumed so descending into it
+      // (its own mediaType/attachmentId keys) does not double-count the image.
+      consumed.add(ref)
     }
 
     if (Array.isArray(obj)) {
@@ -364,18 +368,25 @@ function attachLive(manifest, source) {
  * manifest buried inside an arbitrary result still surfaces. Never throws.
  *
  * @param {unknown} obj
+ * @param {Set<unknown>} [seen]
+ * @param {number} [depth]
  * @returns {Record<string, unknown> | null}
  */
-function extractTranscript(obj) {
+function extractTranscript(obj, seen, depth) {
+  if (depth === undefined) depth = 0
+  if (depth > 20) return null
   if (typeof obj === 'string') {
     try {
       const parsed = JSON.parse(obj)
-      return extractTranscript(parsed)
+      return extractTranscript(parsed, seen, depth + 1)
     } catch {
       return null
     }
   }
   if (!obj || typeof obj !== 'object') return null
+  if (!seen) seen = new Set()
+  if (seen.has(obj)) return null
+  seen.add(obj)
 
   // Direct manifest.
   if (isTranscriptManifest(obj)) return /** @type {Record<string, unknown>} */ (obj)
@@ -397,11 +408,11 @@ function extractTranscript(obj) {
     if (val !== undefined) {
       if (Array.isArray(val)) {
         for (const item of val) {
-          const found = extractTranscript(item)
+          const found = extractTranscript(item, seen, depth + 1)
           if (found) return attachLive(found, o)
         }
       } else {
-        const found = extractTranscript(val)
+        const found = extractTranscript(val, seen, depth + 1)
         if (found) return attachLive(found, o)
       }
     }
@@ -745,6 +756,29 @@ function latestToolResultNode(session, toolName) {
   const messages = safeGet(s, 'messages')
   if (Array.isArray(messages)) {
     const msgs = /** @type {Array<Record<string, unknown>>} */ (messages)
+    // Assistant tool-call variant: the tool result may live on the call object
+    // inside message.tool_calls rather than on session.toolCalls. Scan every
+    // message for a matching call (newest-first) before falling back to the
+    // last message's raw content — a conversational closing message must not
+    // shadow an earlier message's real tool result.
+    for (let i = msgs.length - 1; i >= 0; i--) {
+      const msg = msgs[i]
+      if (!msg) continue
+      const calls = safeGet(msg, 'tool_calls')
+      if (!Array.isArray(calls)) continue
+      const callList = /** @type {Array<Record<string, unknown>>} */ (calls)
+      for (let j = callList.length - 1; j >= 0; j--) {
+        const call = callList[j]
+        if (!call) continue
+        const name = String(safeGet(call, 'name') ?? safeGet(call, 'tool') ?? '')
+        if (name !== toolName && !name.endsWith(toolName)) continue
+        const result = safeGet(call, 'result') ?? safeGet(call, 'response') ?? safeGet(call, 'message')
+        if (result !== undefined && result !== null) return result
+      }
+    }
+    // Fallback: the last message's raw content (pre-existing behavior — a
+    // plain conversational string yields null upstream, but an embedded JSON
+    // body is still worth surfacing for the deep-scan finders).
     for (let i = msgs.length - 1; i >= 0; i--) {
       const msg = msgs[i]
       if (!msg) continue
@@ -1151,6 +1185,7 @@ function computeSummaryFromFindings(findings) {
   const byDimension = {}
 
   for (const f of findings) {
+    if (!f || typeof f !== 'object') continue
     const sev = String(f.severity ?? 'low')
     if (sev in counts) counts[sev]++
     const dim = String(f.dimension ?? 'unknown')
@@ -1224,6 +1259,7 @@ export function severityStats(report) {
   const findings = /** @type {Array<Record<string, unknown>>} */ (report.findings ?? [])
   const counts = { critical: 0, high: 0, medium: 0, low: 0 }
   for (const f of findings) {
+    if (!f || typeof f !== 'object') continue
     const sev = String(f.severity ?? 'low')
     if (sev in counts) counts[sev]++
   }
@@ -1243,6 +1279,7 @@ export function groupByDimension(report) {
   /** @type {Record<string, Array<Record<string, unknown>>>} */
   const groups = {}
   for (const f of findings) {
+    if (!f || typeof f !== 'object') continue
     const dim = String(f.dimension ?? 'unknown')
     if (!groups[dim]) groups[dim] = []
     groups[dim].push(f)
@@ -1412,6 +1449,7 @@ export function normalizeFindingFilter(filter) {
  * @returns {boolean}
  */
 export function findingMatches(finding, filter) {
+  if (!finding || typeof finding !== 'object') return false
   const f = normalizeFindingFilter(filter)
   const sev = String(finding.severity ?? 'low')
   if (f.severities.length > 0 && !f.severities.includes(sev)) return false
@@ -1553,6 +1591,7 @@ export function setAllVerdicts(triageState, verdict, indices) {
 export function buildRoundHistory(report) {
   const rounds = Array.isArray(report.rounds) ? report.rounds : []
   return rounds.map((r) => {
+    if (!r || typeof r !== 'object') return { round: 0, count: 0, critical: 0, high: 0, medium: 0, low: 0 }
     const rr = /** @type {Record<string, unknown>} */ (r)
     const findings = Array.isArray(rr.findings) ? rr.findings : []
     const sev = severityStats({ findings })
@@ -1823,7 +1862,15 @@ export function filterTimelineEntries(entries, opts) {
     if (type && String(t.type ?? '') !== type) return false
     if (round && String(t.round ?? '') !== round) return false
     if (q) {
-      const hay = [String(t.type ?? ''), String(t.round ?? ''), JSON.stringify(t.data ?? {})].join(' ').toLowerCase()
+      let dataText = ''
+      try {
+        dataText = JSON.stringify(t.data ?? {})
+      } catch {
+        // A self-referential `data` reference would throw on stringify — degrade
+        // to a string representation rather than crashing the search.
+        dataText = t.data === undefined ? '{}' : String(t.data)
+      }
+      const hay = [String(t.type ?? ''), String(t.round ?? ''), dataText].join(' ').toLowerCase()
       if (hay.indexOf(q) < 0) return false
     }
     return true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iterate-plugin",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "description": "dsh plugin that turns the iterate skill into an autonomous closed-loop harness with quality command center and experience bank (v3.3). Features: plan -> parallel review xN -> atomic fixes -> validate -> loop -> auto-stop, plus dry-run pure-review mode, quality gate compute/persist, writable experience bank, defense events stream (record + bilingual labels), and native command buttons — with a live quality command center (F8/F9/F10 render real session data), §8 assign-fix instruction, and task_mode indicator wired end to end.",
   "type": "module",
   "license": "MIT",
@@ -29,9 +29,11 @@
     },
     "compatibility": {
       "dshReleases": {
+        "0.1.1-rc.1": "compatible",
         "0.1.2-alpha.4": "compatible",
         "0.1.2-alpha.5": "compatible",
-        "0.1.2-rc.1": "compatible"
+        "0.1.2-rc.1": "compatible",
+        "0.1.3-alpha.1": "compatible"
       }
     },
     "client": {

package/src/client/index.ts

@@ -61,7 +61,6 @@ import {
   batchSetVerdict,
   setAllVerdicts,
   buildRoundHistory,
-  buildFindingTrend,
   computeTrendMetrics,
   trendMax,
   buildCompletionSummary,
@@ -1226,7 +1225,10 @@ function TriagePanel(props: SlotProps) {
 
   // v3.0: Command handlers for native action buttons
   const doApproveArchitecturalFix = () => {
-    const cmd = '请调用 `iterate_fix` 批准架构修复（设置 is_architectural: true）'
+    // Architectural findings exceed the atomic threshold, so "approving" one
+    // means telling the model to apply it as a deliberate forced change via
+    // iterate_fix with force:true (is_architectural is not a real parameter).
+    const cmd = '请调用 `iterate_fix`，对本项目剩余架构型 finding 生成修复内容并设置 force: true 应用（架构修复允许超过 atomic 阈值）'
     copyText(cmd).then((ok) => {
       if (ok) {
         setCmdCopied('approve-arch')
@@ -1246,7 +1248,10 @@ function TriagePanel(props: SlotProps) {
   }
 
   const doRollbackToCheckpoint = () => {
-    const cmd = '请调用 `iterate_checkpoint` 回滚到上一个检查点'
+    // iterate_checkpoint has NO rollback operation (save/load/resume/clear
+    // only); reverting applied fixes is done via iterate_rollback by fix id,
+    // so the paste-able instruction must point there instead.
+    const cmd = '请回滚上一轮迭代的修复：调用 `iterate_history` 查看本轮 fix id，再用 `iterate_rollback` 逐个撤销这些修复'
     copyText(cmd).then((ok) => {
       if (ok) {
         setCmdCopied('rollback')
@@ -2267,7 +2272,10 @@ function ObservatoryPanel(props: SlotProps) {
     const sorted = filtered.slice()
     const rows = sorted.map((t, i) => {
       const k = `f7-${i}`
-      const dataText = t.data && typeof t.data === 'object' ? JSON.stringify(t.data) : ''
+      let dataText = ''
+      if (t.data && typeof t.data === 'object') {
+        try { dataText = JSON.stringify(t.data) } catch { dataText = String(t.data) }
+      }
       return React.createElement('div', { key: k, className: 'iterate-obs-row', style: { flexDirection: 'column', alignItems: 'flex-start' } },
         React.createElement('div', { className: 'iterate-obs-bar', style: { width: '100%' } },
           React.createElement('span', { className: 'iterate-obs-chip' }, String(t.type || '?')),

package/src/git-scope.ts

@@ -23,7 +23,7 @@
 
 import { execFile } from 'node:child_process'
 import { existsSync, statSync } from 'node:fs'
-import { join } from 'node:path'
+import { join, sep } from 'node:path'
 
 /** A resolved changed-only scope result. */
 export interface GitScopeResult {
@@ -113,10 +113,11 @@ export function parseChangedFiles(stdout: string): string[] {
  */
 export function filterExistingFiles(root: string, files: string[]): string[] {
   const out: string[] = []
+  const rootPrefix = root.endsWith(sep) ? root : root + sep
   for (const rel of files) {
     if (rel.startsWith('/') || rel.includes('\0')) continue
     const candidate = join(root, rel)
-    if (!candidate.startsWith(root + '/') && candidate !== root) continue
+    if (!candidate.startsWith(rootPrefix) && candidate !== root) continue
     try {
       if (existsSync(candidate) && statSync(candidate).isFile()) out.push(rel)
     } catch {

package/src/skill-prompt.ts

@@ -143,9 +143,20 @@ for (let r = 1; r <= maxRounds; r++) {
   // Feed the DEDUPED + already-filtered set back (not raw findings) so the known
   // list stays bounded and reviewers never see the same issue twice.
   if (agg && agg.report && Array.isArray(agg.report.findings)) known = agg.report.findings
-  if (agg && agg.report && agg.report.convergence && agg.report.convergence.findingsByRound[r-1] === 0) {
-    log('round ' + r + ' found 0 new findings — converged')
-    break
+  // A round counts as "converged" ONLY when the aggregate accepted it
+  // (schema-valid) AND it genuinely found zero NEW findings. If reviewers all
+  // failed or their output stayed schema-invalid after retries, the round is
+  // INCONCLUSIVE — never report an empty-but-broken round as converged (an
+  // invalid/failed round must fail the run, not masquerade as a clean pass).
+  if (!schemaInvalid) {
+    const newCount =
+      agg && agg.report && agg.report.convergence
+        ? agg.report.convergence.findingsByRound[r - 1]
+        : thisRound.findings.length
+    if (newCount === 0) {
+      log('round ' + r + ' found 0 new findings — converged')
+      break
+    }
   }
 }
 
@@ -238,7 +249,7 @@ if (checkpoint) {
 
 phase('plan')
 const configRes = await agent(
-  'Call iterate_config({ validate: true }) and return the config JSON.',
+  'Call iterate_config({}) and return the config JSON.',
   Object.assign({ label: 'config:read' }, backend)
 )
 const cfg = (configRes && configRes.config) ? configRes.config : null
@@ -421,7 +432,7 @@ for (let r = startRound; r <= maxRounds; r++) {
     Object.assign({ label: 'checkpoint:save:r' + r }, backend)
   )
 
-  if (atomic.length === 0 && remaining.length === 0) {
+  if (atomic.length === 0 && remaining.length === 0 && !schemaInvalid) {
     log('round ' + r + ' found nothing to fix — converged')
     converged = true
     break