iterate-plugin 3.8.0 → 3.9.1

package/lib/client.js

@@ -1,4 +1,4 @@
-/* iterate-plugin client source-digest: fc3f99c3c9a74c891ce54564ac49e7a336441432dfafe0cb21775ee4afe8f411 */
+/* iterate-plugin client source-digest: 2819f2e6f5f182bb31b9e47c356f60e0b8d97fcdbd232c31b89438619623cf93 */
 window.__ModuleLoader__.load({ id: "iterate-plugin", factory: (require) => {
 var module = { exports: {} };
 var exports = module.exports;
@@ -502,18 +502,18 @@ function normalizeTranscript(manifest) {
   const asStr = (v) => typeof v === "string" ? v : "";
   const asBool = (v) => v === true;
   const asCount = (v) => typeof v === "number" ? v : 0;
-  const asArray = (v) => Array.isArray(v) ? (
+  const asArray2 = (v) => Array.isArray(v) ? (
     /** @type {Array<Record<string, unknown>>} */
     v
   ) : [];
-  const rounds = asArray(safeGet(src, "rounds")).map((r) => ({
+  const rounds = asArray2(safeGet(src, "rounds")).map((r) => ({
     round: asNum(safeGet(r, "round")),
-    threads: asArray(safeGet(r, "threads")).map((t2) => ({
+    threads: asArray2(safeGet(r, "threads")).map((t2) => ({
       dimension: asStr(safeGet(t2, "dimension")),
       attempt: asNum(safeGet(t2, "attempt")),
-      messages: asArray(safeGet(t2, "messages")).map((m) => typeof m === "string" ? m : ""),
-      readFiles: asArray(safeGet(t2, "readFiles")).map((f) => typeof f === "string" ? f : ""),
-      findings: asArray(safeGet(t2, "findings")).map((f) => ({ ...f }))
+      messages: asArray2(safeGet(t2, "messages")).map((m) => typeof m === "string" ? m : ""),
+      readFiles: asArray2(safeGet(t2, "readFiles")).map((f) => typeof f === "string" ? f : ""),
+      findings: asArray2(safeGet(t2, "findings")).map((f) => ({ ...f }))
     }))
   }));
   const cp = safeGet(src, "checkpoint");
@@ -538,7 +538,7 @@ function normalizeTranscript(manifest) {
     // v3.0: harness task_mode (code/iterate), tolerated when absent.
     taskMode: tm === "code" || tm === "iterate" ? tm : null,
     goal: asStr(safeGet(src, "goal")),
-    phases: asArray(safeGet(src, "phases")).map((p) => typeof p === "string" ? p : ""),
+    phases: asArray2(safeGet(src, "phases")).map((p) => typeof p === "string" ? p : ""),
     round: asNum(safeGet(src, "round")),
     maxRounds: asNum(safeGet(src, "maxRounds")),
     // v3.5: why a FINISHED run stopped (converged / max_rounds_reached /
@@ -546,17 +546,17 @@ function normalizeTranscript(manifest) {
     // observatory badge to render the stop reason instead of a bare "已结束".
     stoppedReason: src.stoppedReason === null || src.stoppedReason === void 0 ? null : asStr(safeGet(src, "stoppedReason")) || null,
     rounds,
-    convergence: asArray(safeGet(src, "convergence")).map((n) => asCount(n)),
-    findings: asArray(safeGet(src, "findings")).map((f) => ({ ...f })),
-    fixes: asArray(safeGet(src, "fixes")).map((f) => ({ ...f })),
-    live: asArray(safeGet(src, "live")).map((e) => ({
+    convergence: asArray2(safeGet(src, "convergence")).map((n) => asCount(n)),
+    findings: asArray2(safeGet(src, "findings")).map((f) => ({ ...f })),
+    fixes: asArray2(safeGet(src, "fixes")).map((f) => ({ ...f })),
+    live: asArray2(safeGet(src, "live")).map((e) => ({
       ts: typeof safeGet(e, "ts") === "number" ? String(safeGet(e, "ts")) : asStr(safeGet(e, "ts")),
       type: asStr(safeGet(e, "type")),
       tool: asStr(safeGet(e, "tool")),
       target: asStr(safeGet(e, "target"))
     })),
     checkpoint,
-    timeline: asArray(safeGet(src, "timeline")).map((t2) => ({ ...t2 })),
+    timeline: asArray2(safeGet(src, "timeline")).map((t2) => ({ ...t2 })),
     // #6: per-round validation rows (command / exitCode / allowed), captured
     // by the workflow and persisted through `iterate_transcript capture`.
     validations: normalizeValidations(safeGet(src, "validations")),
@@ -1912,6 +1912,411 @@ function latestPhase(phases) {
   return latest;
 }
 
+// src/report-render.ts
+var SEVERITY_ORDER2 = ["critical", "high", "medium", "low"];
+var REPORT_LABELS = {
+  en: {
+    title: "iterate run report",
+    project: "Project",
+    goal: "Goal",
+    mode: "Mode",
+    status: "Status",
+    round: "Round",
+    updated: "Updated",
+    converged: "converged",
+    running: "running",
+    stopped: "stopped",
+    qualityGate: "Quality gate",
+    overall: "Overall",
+    verification: "Verification",
+    dimension: "Dimension",
+    qstatus: "Status",
+    score: "Score",
+    findingsCount: "Findings",
+    fixed: "Fixed",
+    convergence: "Convergence",
+    findings: "Findings",
+    severity: "Severity",
+    location: "Location",
+    summary: "Summary",
+    defensiveType: "Type",
+    none: "_none_",
+    fixes: "Fixes",
+    file: "File",
+    delta: "\u0394",
+    result: "Result",
+    applied: "applied",
+    failed: "failed",
+    validations: "Validations",
+    command: "Command",
+    exit: "Exit",
+    allowed: "Allowed",
+    yes: "yes",
+    no: "no",
+    defenseEvents: "Defense events",
+    experienceBank: "Experience bank",
+    hits: "hits",
+    entries: "entries",
+    generatedAt: "Generated at",
+    notRecorded: "not recorded"
+  },
+  zh: {
+    title: "iterate \u8FD0\u884C\u62A5\u544A",
+    project: "\u9879\u76EE",
+    goal: "\u76EE\u6807",
+    mode: "\u6A21\u5F0F",
+    status: "\u72B6\u6001",
+    round: "\u8F6E\u6B21",
+    updated: "\u66F4\u65B0\u65F6\u95F4",
+    converged: "\u5DF2\u6536\u655B",
+    running: "\u8FD0\u884C\u4E2D",
+    stopped: "\u5DF2\u7ED3\u675F",
+    qualityGate: "\u8D28\u91CF\u95E8\u7981",
+    overall: "\u603B\u4F53",
+    verification: "\u9A8C\u8BC1",
+    dimension: "\u7EF4\u5EA6",
+    qstatus: "\u72B6\u6001",
+    score: "\u5F97\u5206",
+    findingsCount: "\u53D1\u73B0\u6570",
+    fixed: "\u5DF2\u4FEE\u590D",
+    convergence: "\u6536\u655B\u7387",
+    findings: "\u53D1\u73B0",
+    severity: "\u4E25\u91CD\u5EA6",
+    location: "\u4F4D\u7F6E",
+    summary: "\u6458\u8981",
+    defensiveType: "\u7C7B\u578B",
+    none: "\u65E0",
+    fixes: "\u4FEE\u590D",
+    file: "\u6587\u4EF6",
+    delta: "\u53D8\u66F4",
+    result: "\u7ED3\u679C",
+    applied: "\u6210\u529F",
+    failed: "\u5931\u8D25",
+    validations: "\u9A8C\u8BC1",
+    command: "\u547D\u4EE4",
+    exit: "\u9000\u51FA\u7801",
+    allowed: "\u5DF2\u6388\u6743",
+    yes: "\u662F",
+    no: "\u5426",
+    defenseEvents: "\u9632\u5FA1\u4E8B\u4EF6",
+    experienceBank: "\u7ECF\u9A8C\u94F6\u884C",
+    hits: "\u547D\u4E2D",
+    entries: "\u6761\u76EE",
+    generatedAt: "\u751F\u6210\u65F6\u95F4",
+    notRecorded: "\u672A\u8BB0\u5F55"
+  }
+};
+function reportLabels(lang) {
+  return lang === "en" ? REPORT_LABELS.en : REPORT_LABELS.zh;
+}
+function get(source, key) {
+  if (!source || typeof source !== "object") return void 0;
+  try {
+    return source[key];
+  } catch {
+    return void 0;
+  }
+}
+function asString(value) {
+  return typeof value === "string" ? value : "";
+}
+function asNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function asInt(value) {
+  return typeof value === "number" && Number.isFinite(value) ? Math.max(0, Math.floor(value)) : 0;
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function asObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function mdCell(value) {
+  const s = value === null || value === void 0 ? "" : String(value);
+  return s.replace(/\|/g, "\\|").replace(/\r?\n/g, " ").trim();
+}
+function findingSeverity(f) {
+  const s = get(f, "severity");
+  return typeof s === "string" && SEVERITY_ORDER2.includes(s) ? s : "low";
+}
+function sarifUri(file) {
+  const s = typeof file === "string" ? file.trim() : "";
+  if (!s) return "";
+  return s.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function sarifLevel(severity) {
+  if (severity === "critical" || severity === "high") return "error";
+  if (severity === "medium") return "warning";
+  return "note";
+}
+function buildRunReportData(manifest, extra) {
+  const src = asObject(manifest) ?? {};
+  const ex = asObject(extra);
+  const qg = asObject(get(ex, "qualityGate"));
+  const bank = asObject(get(ex, "experienceBank"));
+  const defense = asObject(get(ex, "defenseEvents"));
+  const findings = asArray(get(src, "findings")).map((f) => ({
+    dimension: asString(get(f, "dimension")),
+    file: asString(get(f, "file")),
+    line: asInt(get(f, "line")),
+    severity: findingSeverity(f),
+    summary: asString(get(f, "summary")),
+    failureScenario: asString(get(f, "failure_scenario")),
+    suggestedFix: asString(get(f, "suggested_fix")),
+    isAtomic: get(f, "is_atomic") === true,
+    acknowledged: get(f, "acknowledged") === true
+  }));
+  findings.sort(
+    (a, b) => SEVERITY_ORDER2.indexOf(a.severity) - SEVERITY_ORDER2.indexOf(b.severity)
+  );
+  const fixes = asArray(get(src, "fixes")).map((f) => ({
+    round: asNumber(get(f, "round")),
+    file: asString(get(f, "file")),
+    summary: asString(get(f, "summary")),
+    linesAdded: asNumber(get(f, "linesAdded")),
+    linesRemoved: asNumber(get(f, "linesRemoved")),
+    success: get(f, "success") !== false
+  }));
+  const validations = asArray(get(src, "validations")).map((v) => ({
+    round: asNumber(get(v, "round")),
+    command: asString(get(v, "command")),
+    exitCode: typeof get(v, "exitCode") === "number" ? asInt(get(v, "exitCode")) : null,
+    allowed: get(v, "allowed") === true,
+    rejectReason: asString(get(v, "rejectReason"))
+  }));
+  const severityCounts = { critical: 0, high: 0, medium: 0, low: 0 };
+  for (const f of findings) {
+    const key = f.severity;
+    if (key in severityCounts) severityCounts[key] += 1;
+  }
+  const mode = get(src, "mode");
+  const taskMode = get(src, "taskMode");
+  const stoppedReason = get(src, "stoppedReason");
+  return {
+    project: asString(get(src, "project")),
+    goal: asString(get(src, "goal")),
+    mode: mode === "normal" || mode === "dry-run" ? mode : null,
+    taskMode: taskMode === "code" || taskMode === "iterate" ? taskMode : null,
+    round: asNumber(get(src, "round")),
+    maxRounds: asNumber(get(src, "maxRounds")),
+    // An ABSENT `active` means "no run / unknown", not "running": a missing or
+    // empty transcript used to render a live, pulsing run at round 0. The
+    // transcript builder always writes an explicit boolean, so a strict `true`
+    // only ever loses the phantom run, never a real one.
+    active: get(src, "active") === true,
+    stoppedReason: typeof stoppedReason === "string" && stoppedReason ? stoppedReason : null,
+    updatedAt: asString(get(src, "updatedAt")),
+    convergence: asArray(get(src, "convergence")).filter(
+      (n) => typeof n === "number" && Number.isFinite(n) && n >= 0
+    ),
+    findings,
+    severityCounts,
+    fixes,
+    validations,
+    qualityGate: qg,
+    experienceBank: bank,
+    defenseEvents: defense
+  };
+}
+function reportStatus(data, labels) {
+  if (data.active === true) return labels.running;
+  if (data.stoppedReason) return `${labels.stopped} \xB7 ${data.stoppedReason}`;
+  return labels.stopped;
+}
+function renderRunReportMarkdown(manifest, extra, opts) {
+  const data = buildRunReportData(manifest, extra);
+  const o = opts ?? {};
+  const labels = reportLabels(o.lang === "en" ? "en" : "zh");
+  const when = o.now && o.now ? o.now : (/* @__PURE__ */ new Date()).toISOString();
+  const lines = [];
+  lines.push(`# ${labels.title}`);
+  lines.push("");
+  lines.push(`- **${labels.project}**: \`${mdCell(data.project || labels.notRecorded)}\``);
+  if (data.goal) lines.push(`- **${labels.goal}**: ${mdCell(data.goal)}`);
+  lines.push(
+    `- **${labels.mode}**: ${mdCell(data.mode || labels.notRecorded)}${data.taskMode ? ` \xB7 task_mode: ${data.taskMode}` : ""}`
+  );
+  const roundText = data.maxRounds > 0 ? `${data.round}/${data.maxRounds}` : String(data.round);
+  lines.push(`- **${labels.round}**: ${mdCell(roundText)} \xB7 **${labels.status}**: ${mdCell(reportStatus(data, labels))}`);
+  lines.push(`- **${labels.updated}**: ${mdCell(data.updatedAt || when)}`);
+  lines.push(`- **${labels.generatedAt}**: ${mdCell(when)}`);
+  lines.push("");
+  const qg = data.qualityGate;
+  if (qg) {
+    lines.push(`## ${labels.qualityGate}`);
+    lines.push("");
+    const status = typeof qg.overallStatus === "string" ? qg.overallStatus.toUpperCase() : "PENDING";
+    lines.push(`- **${labels.overall}**: ${mdCell(status)} (${labels.score} ${asNumber(qg.overallScore)})`);
+    lines.push(
+      `- **${labels.verification}**: ${asNumber(qg.passedChecks)}/${asNumber(qg.totalChecks)} (${asNumber(qg.verificationPassRate)}%)`
+    );
+    if (typeof qg.failReason === "string" && qg.failReason) {
+      lines.push(`- ${labels.status}: ${mdCell(qg.failReason)}`);
+    }
+    lines.push("");
+    const dims = asArray(qg.dimensions);
+    if (dims.length > 0) {
+      lines.push(
+        `| ${labels.dimension} | ${labels.qstatus} | ${labels.score} | ${labels.findingsCount} | ${labels.fixed} | ${labels.convergence} |`
+      );
+      lines.push("| --- | --- | --- | --- | --- | --- |");
+      for (const d of dims) {
+        lines.push(
+          `| ${mdCell(get(d, "dimension"))} | ${mdCell(get(d, "status"))} | ${mdCell(get(d, "score"))} | ${mdCell(get(d, "findingsCount"))} | ${mdCell(get(d, "fixedCount"))} | ${mdCell(get(d, "convergenceRate"))}% |`
+        );
+      }
+      lines.push("");
+    }
+  }
+  lines.push(`## ${labels.findings} (${data.findings.length})`);
+  lines.push("");
+  if (data.findings.length === 0) {
+    lines.push(labels.none);
+  } else {
+    lines.push(`| ${labels.severity} | ${labels.dimension} | ${labels.location} | ${labels.summary} |`);
+    lines.push("| --- | --- | --- | --- |");
+    for (const f of data.findings) {
+      const loc = f.file ? `${f.file}${f.line > 0 ? `:${f.line}` : ""}` : "";
+      lines.push(`| ${mdCell(f.severity)} | ${mdCell(f.dimension)} | ${mdCell(loc)} | ${mdCell(f.summary)} |`);
+    }
+  }
+  lines.push("");
+  lines.push(`## ${labels.fixes} (${data.fixes.length})`);
+  lines.push("");
+  if (data.fixes.length === 0) {
+    lines.push(labels.none);
+  } else {
+    lines.push(`| # | ${labels.file} | ${labels.delta} | ${labels.result} | ${labels.summary} |`);
+    lines.push("| --- | --- | --- | --- | --- |");
+    for (const f of data.fixes) {
+      lines.push(
+        `| ${mdCell(f.round)} | ${mdCell(f.file)} | ${mdCell(`+${f.linesAdded}/-${f.linesRemoved}`)} | ${f.success ? labels.applied : labels.failed} | ${mdCell(f.summary)} |`
+      );
+    }
+  }
+  lines.push("");
+  if (data.validations.length > 0) {
+    lines.push(`## ${labels.validations}`);
+    lines.push("");
+    lines.push(`| # | ${labels.command} | ${labels.exit} | ${labels.allowed} |`);
+    lines.push("| --- | --- | --- | --- |");
+    for (const v of data.validations) {
+      lines.push(
+        `| ${mdCell(v.round)} | \`${mdCell(v.command)}\` | ${v.exitCode === null ? "\u2014" : mdCell(v.exitCode)} | ${v.allowed ? labels.yes : labels.no} |`
+      );
+    }
+    lines.push("");
+  }
+  const deEvents = asArray(get(data.defenseEvents, "events"));
+  if (deEvents.length > 0) {
+    lines.push(`## ${labels.defenseEvents} (${deEvents.length})`);
+    lines.push("");
+    lines.push(`| ${labels.severity} | ${labels.defensiveType} | ${labels.round} | ${labels.summary} |`);
+    lines.push("| --- | --- | --- | --- |");
+    for (const e of deEvents) {
+      lines.push(
+        `| ${mdCell(get(e, "severity"))} | ${mdCell(get(e, "type"))} | ${mdCell(get(e, "round"))} | ${mdCell(get(e, "description") || get(e, "outcome"))} |`
+      );
+    }
+    lines.push("");
+  }
+  const entries = asArray(get(data.experienceBank, "entries"));
+  if (entries.length > 0) {
+    const totalHits = asNumber(get(data.experienceBank, "totalHits"));
+    lines.push(`## ${labels.experienceBank} (${entries.length} ${labels.entries}, ${totalHits} ${labels.hits})`);
+    lines.push("");
+    for (const e of entries) {
+      lines.push(
+        `- **[${mdCell(get(e, "id"))}]** ${mdCell(get(e, "pattern"))} \u2014 ${mdCell(get(e, "description"))} (${labels.hits}: ${mdCell(get(e, "hitCount"))})`
+      );
+    }
+    lines.push("");
+  }
+  return lines.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd() + "\n";
+}
+function renderRunReportSarif(manifest, extra, opts) {
+  const data = buildRunReportData(manifest, extra);
+  const o = opts ?? {};
+  const rules = [];
+  const seenRules = /* @__PURE__ */ new Set();
+  for (const f of data.findings) {
+    const id = f.dimension || "review";
+    if (seenRules.has(id)) continue;
+    seenRules.add(id);
+    rules.push({
+      id,
+      name: id,
+      shortDescription: { text: `${id} review dimension` },
+      defaultConfiguration: { level: "warning" }
+    });
+  }
+  const results = data.findings.map((f) => {
+    const result = {
+      ruleId: f.dimension || "review",
+      level: sarifLevel(f.severity),
+      message: { text: f.summary || `${f.severity} finding` },
+      properties: {
+        severity: f.severity,
+        atomic: f.isAtomic,
+        acknowledged: f.acknowledged
+      }
+    };
+    const uri = sarifUri(f.file);
+    if (uri) {
+      result.locations = [
+        {
+          physicalLocation: {
+            artifactLocation: { uri },
+            ...f.line > 0 ? { region: { startLine: f.line } } : {}
+          }
+        }
+      ];
+    }
+    if (f.suggestedFix) result.fixes = [{ description: { text: f.suggestedFix } }];
+    return result;
+  });
+  const failedValidations = data.validations.filter((v) => v.exitCode !== null && v.exitCode !== 0).length;
+  return {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "iterate-plugin",
+            informationUri: o.informationUri && o.informationUri ? o.informationUri : "https://github.com/jingzhao-l/iterate-plugin",
+            ...o.toolVersion ? { version: o.toolVersion } : {},
+            rules
+          }
+        },
+        invocations: [
+          {
+            executionSuccessful: failedValidations === 0 && data.qualityGate?.overallStatus !== "fail",
+            ...data.updatedAt ? { startTimeUtc: data.updatedAt } : {},
+            properties: {
+              mode: data.mode,
+              taskMode: data.taskMode,
+              round: data.round,
+              maxRounds: data.maxRounds,
+              stoppedReason: data.stoppedReason,
+              qualityStatus: data.qualityGate ? data.qualityGate.overallStatus ?? null : null,
+              convergence: data.convergence,
+              findingsBySeverity: data.severityCounts
+            }
+          }
+        ],
+        results
+      }
+    ]
+  };
+}
+function runReportFilename(format, opts) {
+  const ext = format === "sarif" ? "sarif" : "md";
+  const stamp = opts?.now && opts.now ? opts.now.replace(/[:.]/g, "-") : (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  return `iterate-report-${stamp}.${ext}`;
+}
+
 // src/client/i18n.ts
 var LANG_STORAGE_KEY = "iterate-ui-lang";
 var LANG_NAMES = {
@@ -2075,6 +2480,10 @@ var EN = {
   "\u5C06\u89C2\u6D4B\u53F0\u5168\u90E8\u6570\u636E\u5BFC\u51FA\u4E3A JSON\uFF08\u4F18\u5148\u4E0B\u8F7D\uFF0C\u5931\u8D25\u5219\u590D\u5236\uFF09": "Export every observatory panel as JSON (downloads first, falls back to copying)",
   \u5DF2\u5BFC\u51FA: "Exported",
   "\u5BFC\u51FA JSON": "Export JSON",
+  "\u5BFC\u51FA\u62A5\u544A": "Export report",
+  "\u5BFC\u51FA\u53EF\u7C98\u8D34\u8FDB PR \u7684 Markdown \u8FD0\u884C\u62A5\u544A\uFF08\u4F18\u5148\u4E0B\u8F7D\uFF0C\u5931\u8D25\u5219\u590D\u5236\uFF09": "Export a PR-pasteable Markdown run report (download first, copy on failure)",
+  "\u5BFC\u51FA SARIF": "Export SARIF",
+  "\u5BFC\u51FA SARIF 2.1.0\uFF08\u4F9B CI / GitHub Code Scanning \u6D88\u8D39\uFF09": "Export SARIF 2.1.0 for CI / GitHub Code Scanning",
   "\u89C2\u6D4B\u53F0\u9875\u7B7E\uFF08\u5FEB\u6377\u952E 1-9 / 0 / -\uFF09": "Observatory tabs (keys 1-9 / 0 / -)",
   "{a0}\uFF08\u6309 {a1} \u5207\u6362\uFF09": "{a0} (press {a1})",
   "{a0}\uFF08\u6309 - \u5207\u6362\uFF09": "{a0} (press -)",
@@ -4083,6 +4492,29 @@ function ObservatoryPanel(props) {
       flash();
     });
   };
+  const exportReport = (format) => {
+    if (!manifest) return;
+    const extra = { qualityGate, experienceBank, defenseEvents };
+    const content = format === "sarif" ? JSON.stringify(renderRunReportSarif(manifest, extra), null, 2) : renderRunReportMarkdown(manifest, extra, { lang: getLang() });
+    const filename = runReportFilename(format);
+    const key = `report-${format}`;
+    const flash = () => {
+      setCopiedKey(key);
+      if (copyTimer.current) clearTimeout(copyTimer.current);
+      copyTimer.current = setTimeout(() => setCopiedKey((cur) => cur === key ? null : cur), 1600);
+    };
+    if (downloadTextFile(filename, content)) {
+      flash();
+      return;
+    }
+    copyText(content).then((ok) => {
+      if (!ok) {
+        setCopyFailText(content);
+        return;
+      }
+      flash();
+    });
+  };
   const setAllThreads = (mode) => {
     setThreadMode(mode);
     setExpandedThreads(/* @__PURE__ */ new Set());
@@ -5278,6 +5710,21 @@ function ObservatoryPanel(props) {
           onClick: exportObservatory,
           title: t("\u5C06\u89C2\u6D4B\u53F0\u5168\u90E8\u6570\u636E\u5BFC\u51FA\u4E3A JSON\uFF08\u4F18\u5148\u4E0B\u8F7D\uFF0C\u5931\u8D25\u5219\u590D\u5236\uFF09")
         }, copiedKey === "export" ? t("\u5DF2\u5BFC\u51FA") : t("\u5BFC\u51FA JSON")),
+        // v3.9: portable report export — Markdown for a PR body, SARIF for
+        // CI / GitHub Code Scanning. Rendered from the same data model as
+        // the `iterate_report` tool.
+        React.createElement("button", {
+          className: "iterate-btn",
+          "data-copied": copiedKey === "report-markdown" ? "" : void 0,
+          onClick: () => exportReport("markdown"),
+          title: t("\u5BFC\u51FA\u53EF\u7C98\u8D34\u8FDB PR \u7684 Markdown \u8FD0\u884C\u62A5\u544A\uFF08\u4F18\u5148\u4E0B\u8F7D\uFF0C\u5931\u8D25\u5219\u590D\u5236\uFF09")
+        }, copiedKey === "report-markdown" ? t("\u5DF2\u5BFC\u51FA") : t("\u5BFC\u51FA\u62A5\u544A")),
+        React.createElement("button", {
+          className: "iterate-btn",
+          "data-copied": copiedKey === "report-sarif" ? "" : void 0,
+          onClick: () => exportReport("sarif"),
+          title: t("\u5BFC\u51FA SARIF 2.1.0\uFF08\u4F9B CI / GitHub Code Scanning \u6D88\u8D39\uFF09")
+        }, copiedKey === "report-sarif" ? t("\u5DF2\u5BFC\u51FA") : t("\u5BFC\u51FA SARIF")),
         // Gap #4: `.iterate/` artifacts are unreachable from the browser;
         // this copies the one instruction that makes the model echo them
         // into the session stream (which is what every panel scans).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iterate-plugin",
-  "version": "3.8.0",
+  "version": "3.9.1",
   "description": "dsh plugin that turns the iterate skill into an autonomous closed-loop harness with quality command center and experience bank (v3.3). Features: plan -> parallel review xN -> atomic fixes -> validate -> loop -> auto-stop, plus dry-run pure-review mode, quality gate compute/persist, writable experience bank, defense events stream (record + bilingual labels), and native command buttons — with a live quality command center (F8/F9/F10 render real session data), §8 assign-fix instruction, and task_mode indicator wired end to end.",
   "type": "module",
   "license": "MIT",
@@ -48,7 +48,10 @@
         "0.2.1-alpha.1": "compatible",
         "0.2.1-alpha.2": "compatible",
         "0.2.1-alpha.3": "compatible",
-        "0.2.1-alpha.4": "compatible"
+        "0.2.1-alpha.4": "compatible",
+        "0.2.1-alpha.5": "compatible",
+        "0.2.1-rc.1": "compatible",
+        "0.2.1-rc.2": "compatible"
       }
     },
     "client": {
@@ -89,13 +92,17 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.5-alpha.2",
-    "@deepseek-ai/dsh-tools": "0.1.1-rc.1 || 0.1.2-alpha.4 || 0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4",
-    "@deepseek-ai/dsh-util-values": "0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4"
+    "@deepseek-ai/dsh-session": "0.1.1-rc.1 || 0.1.2-alpha.4 || 0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.1-rc.1 || 0.1.2-alpha.4 || 0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-util-values": "0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
       "optional": true
     },
+    "@deepseek-ai/dsh-session": {
+      "optional": true
+    },
     "@deepseek-ai/dsh-tools": {
       "optional": true
     },
@@ -104,12 +111,12 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.5-alpha.2",
-    "@deepseek-ai/dsh-agent": "0.2.1-alpha.4",
-    "@deepseek-ai/dsh-jobs": "0.2.1-alpha.4",
-    "@deepseek-ai/dsh-session": "0.2.1-alpha.4",
-    "@deepseek-ai/dsh-tools": "0.2.1-alpha.4",
-    "@deepseek-ai/dsh-util-values": "0.2.1-alpha.4",
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/dsh-agent": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-jobs": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-util-values": "0.2.1-rc.2",
     "@types/js-yaml": "4.0.9",
     "@types/node": "22.15.0",
     "@types/react": "19.2.2",

package/src/client/i18n.ts

@@ -253,6 +253,12 @@ export const EN: Record<string, string> = {
     'Export every observatory panel as JSON (downloads first, falls back to copying)',
   已导出: 'Exported',
   '导出 JSON': 'Export JSON',
+  '导出报告': 'Export report',
+  '导出可粘贴进 PR 的 Markdown 运行报告（优先下载，失败则复制）':
+    'Export a PR-pasteable Markdown run report (download first, copy on failure)',
+  '导出 SARIF': 'Export SARIF',
+  '导出 SARIF 2.1.0（供 CI / GitHub Code Scanning 消费）':
+    'Export SARIF 2.1.0 for CI / GitHub Code Scanning',
   '观测台页签（快捷键 1-9 / 0 / -）': 'Observatory tabs (keys 1-9 / 0 / -)',
   '{a0}（按 {a1} 切换）': '{a0} (press {a1})',
   '{a0}（按 - 切换）': '{a0} (press -)',

package/src/client/index.ts

@@ -108,6 +108,13 @@ import {
   configValueByPath, // #8b: current value of the selected dotted key
   DISK_SNAPSHOT_SOURCES, // #4/#3: read-side tools listed by the pull instruction
 } from '../../lib/parse.js'
+// v3.9: report export — shared with the `iterate_report` tool so the button
+// and the tool can never produce different reports.
+import {
+  renderRunReportMarkdown, // Markdown run report (PR-pasteable)
+  renderRunReportSarif, // SARIF 2.1.0 log (CI / Code Scanning)
+  runReportFilename, // deterministic download filename
+} from '../report-render.ts'
 import {
   configureLangStorage,
   detectLang,
@@ -2408,6 +2415,30 @@ function ObservatoryPanel(props: SlotProps) {
     })
   }
 
+  /** v3.9: export the run as a portable report — Markdown (PR-pasteable) or
+   *  SARIF 2.1.0 (CI / GitHub Code Scanning). Rendered from the SAME shared
+   *  data model as the `iterate_report` tool, so the button and the tool can
+   *  never disagree. Download-first with a copy fallback, like `exportObservatory`. */
+  const exportReport = (format: 'markdown' | 'sarif') => {
+    if (!manifest) return
+    const extra = { qualityGate, experienceBank, defenseEvents }
+    const content = format === 'sarif'
+      ? JSON.stringify(renderRunReportSarif(manifest, extra), null, 2)
+      : renderRunReportMarkdown(manifest, extra, { lang: getLang() })
+    const filename = runReportFilename(format)
+    const key = `report-${format}`
+    const flash = () => {
+      setCopiedKey(key)
+      if (copyTimer.current) clearTimeout(copyTimer.current)
+      copyTimer.current = setTimeout(() => setCopiedKey((cur) => (cur === key ? null : cur)), 1600)
+    }
+    if (downloadTextFile(filename, content)) { flash(); return }
+    copyText(content).then((ok) => {
+      if (!ok) { setCopyFailText(content); return }
+      flash()
+    })
+  }
+
   /** Force every thread open (or closed) and drop per-thread state. */
   const setAllThreads = (mode: 'all' | 'none') => {
     setThreadMode(mode)
@@ -3449,6 +3480,19 @@ function ObservatoryPanel(props: SlotProps) {
               onClick: exportObservatory,
               title: t('将观测台全部数据导出为 JSON（优先下载，失败则复制）'),
             }, copiedKey === 'export' ? t('已导出') : t('导出 JSON')),
+            // v3.9: portable report export — Markdown for a PR body, SARIF for
+            // CI / GitHub Code Scanning. Rendered from the same data model as
+            // the `iterate_report` tool.
+            React.createElement('button', {
+              className: 'iterate-btn', 'data-copied': copiedKey === 'report-markdown' ? '' : undefined,
+              onClick: () => exportReport('markdown'),
+              title: t('导出可粘贴进 PR 的 Markdown 运行报告（优先下载，失败则复制）'),
+            }, copiedKey === 'report-markdown' ? t('已导出') : t('导出报告')),
+            React.createElement('button', {
+              className: 'iterate-btn', 'data-copied': copiedKey === 'report-sarif' ? '' : undefined,
+              onClick: () => exportReport('sarif'),
+              title: t('导出 SARIF 2.1.0（供 CI / GitHub Code Scanning 消费）'),
+            }, copiedKey === 'report-sarif' ? t('已导出') : t('导出 SARIF')),
             // Gap #4: `.iterate/` artifacts are unreachable from the browser;
             // this copies the one instruction that makes the model echo them
             // into the session stream (which is what every panel scans).