paseo-req-kit 1.14.0-beta.3 → 1.14.0-beta.5

package/engine/src/danger-guard.ts

@@ -0,0 +1,180 @@
+// Stopping dangerous commands (1.14): step agents usually run commands without asking (the
+// provider's "no confirmation" mode), so the rules "only local commits, never touch production"
+// were only words in the prompt. While a step runs, the pipeline looks at the commands the agent
+// has run or is running (its Paseo timeline, every few seconds to a minute); a command that
+// pushes, publishes, changes a cluster, connects to a remote database or host, deletes outside
+// the repository, runs a downloaded script, or mentions a configured production address is
+// interrupted (if still running) and reported to the person. A plain check of the command
+// text, no model; it catches the common cases, it is not a sandbox.
+import os from "node:os";
+import path from "node:path";
+
+export interface DangerGuardSettings {
+  enabled: boolean;
+  /** Text that marks a production system (host names, addresses, database names); any command containing it is stopped. */
+  production: string[];
+  /** Regular expressions of commands that are allowed after all (e.g. "^ssh test-box"). */
+  allow: string[];
+}
+
+export interface ToolCall {
+  callId: string;
+  kind: string;
+  text: string;
+  status: string;
+  startedAt: string;
+}
+
+export interface Danger {
+  /** What kind of operation it is, for the person (e.g. "推送到远程仓库"). */
+  label: string;
+  /** Why it is not allowed in a pipeline step. */
+  why: string;
+}
+
+const LOCAL_HOSTS = /^(localhost|127(\.\d+){3}|0\.0\.0\.0|::1|\[::1\]|host\.docker\.internal)$/i;
+
+/** Splits a command line into simple commands (on ; && || | and newlines), each a list of words without quotes. */
+export function segments(command: string): string[][] {
+  const out: string[][] = [];
+  for (const part of command.split(/\|\||&&|[;|\n]|\r/)) {
+    const words = (part.match(/"[^"]*"|'[^']*'|\S+/g) ?? []).map((w) => w.replace(/^["']|["']$/g, ""));
+    // Wrappers that run the rest as a command.
+    while (words.length && /^(sudo|env|nohup|time|exec|command|xargs|npx|cmd(\.exe)?|\/c|powershell(\.exe)?|pwsh|-Command|-c|bash|sh|zsh|-lc|-l)$/i.test(words[0])) words.shift();
+    while (words.length && /^\w+=/.test(words[0])) words.shift();
+    // A command given as one quoted argument (bash -lc "git push"): look inside it.
+    if (words.length && /\s/.test(words[0])) out.push(...segments(words.join(" ")));
+    else if (words.length) out.push(words);
+  }
+  return out;
+}
+
+const base = (w: string) => w.replace(/\\/g, "/").split("/").pop()!.replace(/\.(exe|cmd|bat)$/i, "").toLowerCase();
+
+function hostOf(value: string): string {
+  const v = value.replace(/^\w+:\/\//, "").replace(/^[^@/]*@/, "");
+  return v.replace(/[:/].*$/, "");
+}
+
+/** A host that is clearly another machine: an address or a dotted name that is not this machine. Service names of docker compose ("db") count as local. */
+function remoteHost(host: string): boolean {
+  if (!host || LOCAL_HOSTS.test(host)) return false;
+  return /\./.test(host) || /^\d+(\.\d+){3}$/.test(host);
+}
+
+function deletesOutside(words: string[], repo: string | null, home: string): string | null {
+  const targets = words.slice(1).filter((w) => !w.startsWith("-") && !/^\/[a-z]$/i.test(w));
+  const h = home.replace(/\\/g, "/").replace(/\/+$/, "");
+  for (const raw of targets) {
+    const t = raw.replace(/\\/g, "/").replace(/\/+$/, "") || "/";
+    if (/^(\/|\/\*|~|~\/\*|\$HOME|\$\{HOME\}|%USERPROFILE%|\$env:USERPROFILE|[a-z]:|[a-z]:\/\*|\.\.(\/\.\.)*(\/\*)?|\*|\/\*\.\*)$/i.test(t)) return raw;
+    if (t === h) return raw;
+    if (/^(\/|[a-z]:\/)/i.test(t)) {
+      const abs = path.resolve(t);
+      const inside = (dir: string | null) => !!dir && (abs === path.resolve(dir) || abs.startsWith(path.resolve(dir) + path.sep));
+      if (!inside(repo) && !inside(os.tmpdir()) && !/^\/(tmp|var\/tmp)(\/|$)/.test(t)) return raw;
+    }
+  }
+  return null;
+}
+
+function judgeSegment(words: string[], repo: string | null, home: string): Danger | null {
+  const cmd = base(words[0]);
+  const rest = words.slice(1);
+  const sub = rest.find((w) => !w.startsWith("-"))?.toLowerCase() ?? "";
+  const has = (re: RegExp) => rest.some((w) => re.test(w));
+
+  if (cmd === "git") {
+    // Skip global options (-C dir, -c k=v) to find the git command.
+    let i = 0;
+    while (i < rest.length && rest[i].startsWith("-")) i += /^-[Cc]$/.test(rest[i]) ? 2 : 1;
+    const g = rest[i]?.toLowerCase();
+    const args = rest.slice(i + 1);
+    if (g === "push") {
+      const force = args.some((w) => /^(--force|--force-with-lease|-f|--mirror|--delete|-d)$/.test(w) || /^\+/.test(w) || /^--force-with-lease=/.test(w) || /^:/.test(w));
+      return force
+        ? { label: "强制推送或删除远程分支", why: "会改写或删除远程仓库的历史，别人的提交可能丢失" }
+        : { label: "推送到远程仓库", why: "流水线只做本地提交，推送和合并由人决定（接单器模式由流水线自己推送需求分支）" };
+    }
+    if (g === "remote" && /^(add|set-url|remove|rm)$/.test(args[0] ?? "")) return { label: "修改远程仓库地址", why: "会改变代码推送到哪里" };
+    return null;
+  }
+  if (cmd === "rm" && rest.some((w) => /^-[a-z]*r/i.test(w) || w === "--recursive")) {
+    const t = deletesOutside(words, repo, home);
+    if (t) return { label: `删除仓库以外的目录（${t}）`, why: "会删除仓库以外的文件，无法恢复" };
+  }
+  if (/^(remove-item|ri|rd|rmdir|del|erase)$/.test(cmd) && has(/^(-recurse|-r|\/s)$/i)) {
+    const t = deletesOutside(words.filter((w) => !/^-(recurse|force|r)$/i.test(w) && !/^\/[sq]$/i.test(w)), repo, home);
+    if (t) return { label: `删除仓库以外的目录（${t}）`, why: "会删除仓库以外的文件，无法恢复" };
+  }
+  if (/^(npm|pnpm|yarn|cargo|gem|twine|poetry|flit)$/.test(cmd) && (sub === "publish" || (sub === "npm" && rest[1] === "publish") || (cmd === "gem" && sub === "push") || (cmd === "twine" && sub === "upload")))
+    return { label: "发布包到制品仓库", why: "发布出去的版本别人马上能用到，撤不回来" };
+  if (/^(mvn|mvnw)$/.test(cmd) && has(/^(deploy|release:perform|deploy:deploy(-file)?)$/)) return { label: "发布制品（mvn deploy）", why: "发布出去的版本别人马上能用到，撤不回来" };
+  if (/^(gradle|gradlew)$/.test(cmd) && has(/^(publish\w*|uploadArchives)$/)) return { label: "发布制品（gradle publish）", why: "发布出去的版本别人马上能用到，撤不回来" };
+  if (cmd === "docker" && sub === "push") return { label: "推送镜像到镜像仓库", why: "镜像仓库是共享的，部署可能直接用到" };
+  if (cmd === "docker" && sub === "login") return { label: "登录镜像仓库", why: "会在这台机器上保存镜像仓库的凭据" };
+  if (cmd === "dotnet" && sub === "nuget" && rest[1] === "push") return { label: "发布包到制品仓库", why: "发布出去的版本别人马上能用到，撤不回来" };
+  if (/^(kubectl|oc)$/.test(cmd) && /^(apply|create|delete|replace|patch|scale|rollout|edit|drain|cordon|exec|cp|set|label|annotate|run)$/.test(sub))
+    return { label: "修改集群（kubectl）", why: "会改动共享的环境，流水线只在本地或测试环境验证" };
+  if (cmd === "helm" && /^(install|upgrade|uninstall|delete|rollback)$/.test(sub)) return { label: "修改集群（helm）", why: "会改动共享的环境，流水线只在本地或测试环境验证" };
+  if (cmd === "terraform" && /^(apply|destroy|import|taint)$/.test(sub)) return { label: "修改基础设施（terraform）", why: "会改动共享的环境，流水线只在本地或测试环境验证" };
+  if (cmd === "ansible-playbook" || (cmd === "ansible" && !has(/^(--check|-C)$/))) return { label: "在服务器上执行（ansible）", why: "会改动其他机器" };
+  if (/^(mysql|mysqldump|psql|pg_dump|mongo|mongosh|redis-cli|sqlcmd|sqlplus|clickhouse-client|clickhouse)$/.test(cmd)) {
+    for (let i = 0; i < rest.length; i++) {
+      const w = rest[i];
+      let host: string | null = null;
+      const m = /^(-h|--host|-H|-S|--server)(=?)(.*)$/.exec(w);
+      if (m) host = m[3] || rest[i + 1] || "";
+      else if (/^\w+:\/\//.test(w)) host = hostOf(w);
+      else if (cmd === "sqlplus" && /@/.test(w)) host = hostOf(w.split("@").pop() ?? "");
+      if (host !== null && remoteHost(host.replace(/,\d+$/, ""))) return { label: `连接其他机器上的数据库（${host}）`, why: "可能是共享或生产的数据库；流水线只用本机或测试用的数据库" };
+    }
+  }
+  if (/^(ssh|scp|sftp|rsync)$/.test(cmd)) {
+    const target = rest.find((w) => !w.startsWith("-") && (cmd === "ssh" || cmd === "sftp" || /:/.test(w)));
+    if (target && !/^git@/.test(target)) {
+      const host = cmd === "ssh" || cmd === "sftp" ? hostOf(target) : hostOf(target.split(":")[0]);
+      if (host && !LOCAL_HOSTS.test(host)) return { label: `登录或复制文件到其他机器（${host}）`, why: "会改动其他机器；流水线只在本地或测试环境验证" };
+    }
+  }
+  if (/^(shutdown|reboot|halt|poweroff|mkfs|diskpart|format|stop-computer|restart-computer)$/.test(cmd) || /^mkfs\./.test(cmd)) return { label: "系统级操作", why: "会影响整台机器" };
+  if (cmd === "dd" && has(/^of=\/dev\//)) return { label: "直接写磁盘", why: "会破坏磁盘上的数据" };
+  if (/^(chmod|chown)$/.test(cmd) && has(/^-R$/) && rest.some((w) => /^(\/|~|\$HOME)\/?$/.test(w))) return { label: "修改整个系统的权限", why: "会影响整台机器" };
+  return null;
+}
+
+/** Whether a command (or a fetched address) is one a pipeline step must not run, and why. */
+export function dangerOf(text: string, settings: Pick<DangerGuardSettings, "production" | "allow">, options: { repo?: string | null; home?: string } = {}): Danger | null {
+  if (!text.trim()) return null;
+  for (const a of settings.allow) {
+    try {
+      if (new RegExp(a, "i").test(text)) return null;
+    } catch {
+      /* validated with the configuration */
+    }
+  }
+  const lower = text.toLowerCase();
+  for (const p of settings.production) {
+    if (p.trim() && lower.includes(p.trim().toLowerCase())) return { label: `访问生产环境（${p.trim()}）`, why: "流水线不连接生产环境、不使用生产凭据" };
+  }
+  if (/\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(ba|z|da)?sh\b/i.test(text) || /\b(iwr|irm|invoke-webrequest|invoke-restmethod)\b[^|]*\|\s*(iex|invoke-expression)\b/i.test(text))
+    return { label: "下载脚本直接执行", why: "执行的内容没有经过检查" };
+  const home = options.home ?? os.homedir();
+  for (const words of segments(text)) {
+    const d = judgeSegment(words, options.repo ?? null, home);
+    if (d) return d;
+  }
+  return null;
+}
+
+/** What the agent is told when the command is stopped (or was found after it ran). */
+export function dangerMessage(command: string, danger: Danger, ran: boolean): string {
+  const one = command.replace(/\s+/g, " ").trim();
+  const clip = one.length > 160 ? `${one.slice(0, 159)}…` : one;
+  return [
+    `【流水线提示】${ran ? "你刚才运行了" : "已停止你正在运行的"}命令「${clip}」：这是${danger.label}，${danger.why}。需求开发流水线里不允许这类操作，用户已收到通知。`,
+    "- 不要再运行这条命令，也不要换一种写法做同样的事。",
+    `- ${ran ? "如果它已经改动了仓库以外或远程的东西，不要自己试图撤销；" : ""}在本步骤产物里写一节\"风险操作\"：运行了什么、为什么、${ran ? "造成了什么影响" : "是否已经产生影响"}。`,
+    "- 然后继续完成本步骤的任务：需要推送、发布、部署或连接其他环境的，写进产物的\"需要人处理\"，由人来做。",
+  ].join("\n");
+}

package/engine/src/features.ts

@@ -83,7 +83,7 @@ interface RawState {
  * Files only the pipeline writes: their presence means it ran, even where its state is not (a
  * copy merged into the main branch: the state file under .pipeline/ is never committed).
  */
-const PIPELINE_OUTPUTS = ["design.md", "assessment.md", "diagnosis.md", "implementation.md", "handoff.md", "verification.md", "report.md"];
+export const PIPELINE_OUTPUTS = ["design.md", "assessment.md", "diagnosis.md", "implementation.md", "handoff.md", "verification.md", "report.md"];
 
 export function developedIn(dir: string): boolean {
   return PIPELINE_OUTPUTS.some((f) => fs.existsSync(path.join(dir, f)));

package/engine/src/main.ts

@@ -1,6 +1,7 @@
 // The long-running pipeline process. Normally started by launch.ts, detached
 // from the chat agent's shell; can also be run in the foreground for debugging.
 
+import { pendingHumanReview, writeHumanReview } from "./code-review.js";
 import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
@@ -191,11 +192,20 @@ async function main(): Promise<number> {
       approval:
         args.approve && mode.previous.status === "waiting_for_approval"
           ? { attempt: mode.previous.attempt, status: "approved", at: now }
-          : startOver
-            ? null
-            : (mode.previous.approval ?? null),
+          : // 1.14: code review comments do not change what the requester confirmed: no second confirmation.
+            args.reviewFix && mode.previous.approval?.status === "approved"
+            ? { ...mode.previous.approval, attempt: mode.previous.attempt + 1 }
+            : startOver
+              ? null
+              : (mode.previous.approval ?? null),
       gate: mode.kind === "restart" ? null : (mode.previous.gate ?? null),
     };
+    // 1.14: the person's code review comments are this attempt's to handle.
+    if (args.reviewFix && mode.kind === "resume-from-design") {
+      const featureAbs = path.join(repo, featureDir);
+      const pending = pendingHumanReview(featureAbs);
+      if (pending) writeHumanReview(featureAbs, { ...pending, consumedAttempt: mode.previous.attempt + 1 });
+    }
     if (checked.entersVerify) {
       // A develop-only run that ends with its development report gets a full report after verification.
       delete state.results.report;

package/engine/src/messages.ts

@@ -54,6 +54,24 @@ export function permissionMessage(input: {
   ].join("\n");
 }
 
+/** 1.14: a step agent ran (or started) a dangerous command; the pipeline stopped it. */
+export function dangerNotice(input: { stepTitle: string; agentTitle: string; command: string; label: string; ran: boolean }): string {
+  const one = input.command.replace(/\s+/g, " ").trim();
+  return [
+    HEADER,
+    "",
+    `流水线的「${input.stepTitle}」步骤里，agent ${input.ran ? "运行了" : "开始运行"}一条不允许的命令（${input.label}），${input.ran ? "流水线发现时它已经运行完" : "流水线已经打断了它"}：`,
+    "",
+    "```text",
+    one.length > 300 ? `${one.slice(0, 299)}…` : one,
+    "```",
+    "",
+    input.ran
+      ? `请告诉用户这件事，并请用户检查它有没有改动仓库以外或远程的东西（例如远程分支、制品仓库、集群、其他机器、数据库）。需要撤销的由用户处理；不要自己去撤销。agent「${input.agentTitle}」已被告知不要再这样做，流水线继续。`
+      : `请告诉用户这件事。agent「${input.agentTitle}」已被告知不要再这样做，流水线继续；如果这条命令其实是允许的，可以在配置 dangerGuard.allow 里放行。`,
+  ].join("\n");
+}
+
 export function failedMessage(input: {
   stepTitle: string;
   reason: string;
@@ -427,3 +445,14 @@ export function pluginReplyMessage(input: { featureDir: string; waitingFor: "bus
       : "请这样处理：按 /req 中\"需要需求方决定\"的做法，把回答记入 alignment.md 并更新 spec.md；回答已经覆盖全部问题时，向用户简要复述后执行继续命令；还缺的，在对话里接着问。",
   ].join("\n");
 }
+
+/** 1.14: the requirement's chat is reminded once that a confirmed spec has not started development. */
+export function notStartedNotice(featureDir: string): string {
+  return [
+    "【需求开发流水线提示】这条消息来自 req-kit 的后台检查，不是用户发的。",
+    "",
+    `需求 ${featureDir} 的需求说明已经确认超过 30 分钟，但开发流水线还没有启动。`,
+    "如果用户确实要开发它：请按 /req 的手册启动开发（或者告诉用户可以在插件\"等你处理\"里点\"开始开发\"）。",
+    "如果是用户有意先不开发、还要再改需求，或者已经在别处开始了：用一句话确认即可，不需要其他操作。这个提醒只发一次。",
+  ].join("\n");
+}

package/engine/src/outcomes.ts

@@ -0,0 +1,145 @@
+// What happened after the run (1.14): whether each requirement's change reached the main line,
+// and problems found after that. Recorded as events in the usage records (records.ts), so
+// `req stats` can report merges and post-merge problems next to the runs. Merges are found
+// from what is already in the local repository (no fetch): the requirement's pipeline files
+// (implementation.md, report.md, …) are in the main line's tree. A defect requirement whose spec
+// says "- 引入问题的需求：<目录名或标题>" counts as a problem of that requirement.
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { PIPELINE_OUTPUTS } from "./features.js";
+import { appendEvent, type EventRecord, type IndexEntry, readEvents, readIndex, requirementRef, runsFile } from "./records.js";
+
+function git(repo: string, args: string[]): string | null {
+  try {
+    return execFileSync("git", args, { cwd: repo, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], windowsHide: true });
+  } catch {
+    return null;
+  }
+}
+
+/** The main line of a repository as known locally: origin's default branch, else main or master. */
+export function mainLine(repo: string): string | null {
+  const head = git(repo, ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"])?.trim();
+  for (const ref of [head, "origin/main", "origin/master", "main", "master"]) {
+    if (ref && git(repo, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]) !== null) return ref;
+  }
+  return null;
+}
+
+/** Whether the requirement's change is in the main line, with the commit that brought it there. */
+export function mergeOf(repo: string, featureDir: string): NonNullable<EventRecord["merge"]> | null {
+  const ref = mainLine(repo);
+  if (!ref) return null;
+  const fd = featureDir.split(path.sep).join("/");
+  const marker = PIPELINE_OUTPUTS.find((f) => git(repo, ["cat-file", "-e", `${ref}:${fd}/${f}`]) !== null);
+  if (!marker) return null;
+  const line = git(repo, ["log", "--first-parent", "--diff-filter=A", "-1", "--format=%H%x09%cI", ref, "--", `${fd}/${marker}`])?.trim() ?? "";
+  const [commit, at] = line.split("\t");
+  return { into: ref, commit: commit ? commit.slice(0, 12) : null, mergedAt: at || null, how: "files" };
+}
+
+/** The spec of a requirement: in its directory, or (worktree removed) in the main line. */
+function specOf(entry: IndexEntry): string | null {
+  const file = path.join(entry.repo, entry.featureDir, "spec.md");
+  if (fs.existsSync(file)) return fs.readFileSync(file, "utf8");
+  const repo = [entry.sourceRepo, entry.repo].find((r): r is string => !!r && fs.existsSync(r));
+  const ref = repo ? mainLine(repo) : null;
+  return repo && ref ? git(repo, ["show", `${ref}:${entry.featureDir}/spec.md`]) : null;
+}
+
+const CAUSED_BY = /^\s*[-*]\s*引入问题的需求[:：]\s*(.+?)\s*$/m;
+
+/**
+ * Looks at every requirement this machine knows (the index) and records what is new: merges
+ * into the main line, and defect requirements that name the requirement that caused them.
+ * Returns the events it added. Never throws.
+ */
+export function scanOutcomes(env: NodeJS.ProcessEnv = process.env): EventRecord[] {
+  const added: EventRecord[] = [];
+  try {
+    const events = readEvents(runsFile(env));
+    const merged = new Set(events.filter((e) => e.kind === "merge").map((e) => `${e.requirement.project}\0${e.requirement.key}`));
+    const issues = new Set(events.filter((e) => e.kind === "issue").map((e) => e.issue?.id));
+    const entries = readIndex(env);
+    for (const entry of entries) {
+      const repo = [entry.sourceRepo, entry.repo].find((r): r is string => !!r && fs.existsSync(r));
+      if (!repo) continue;
+      const ref = requirementRef(entry.repo, entry.featureDir, env);
+      if (!merged.has(`${ref.project}\0${ref.key}`)) {
+        const m = mergeOf(repo, entry.featureDir);
+        if (m) {
+          const e = { kind: "merge" as const, requirement: ref, merge: m };
+          appendEvent(e, env);
+          added.push({ schema: 1, machine: "", kitVersion: "", at: new Date().toISOString(), ...e });
+          merged.add(`${ref.project}\0${ref.key}`);
+        }
+      }
+      const cause = CAUSED_BY.exec(specOf(entry) ?? "")?.[1];
+      const id = `defect:${entry.key}`;
+      if (!cause || issues.has(id)) continue;
+      const target = entries.find((o) => o.key !== entry.key && (path.basename(o.featureDir) === cause || o.featureDir === cause || requirementRef(o.repo, o.featureDir, env).title === cause));
+      if (!target) continue;
+      const e = { kind: "issue" as const, requirement: requirementRef(target.repo, target.featureDir, env), issue: { text: ref.title, by: ref.name, id } };
+      appendEvent(e, env);
+      added.push({ schema: 1, machine: "", kitVersion: "", at: new Date().toISOString(), ...e });
+      issues.add(id);
+    }
+  } catch {
+    // Outcomes are a convenience for the statistics.
+  }
+  return added;
+}
+
+const USAGE = `用法：
+  req outcome                          查找已经合并进主干的需求、合并后发现的问题（缺陷需求里写了"引入问题的需求"），记入使用记录
+  req outcome <需求> --merged [--commit <提交>]   手动记一笔：这个需求已经合并（例如合并后删掉了需求目录）
+  req outcome <需求> --issue "<问题>"             手动记一笔：这个需求合并后发现的问题
+
+合并是从本机仓库里已有的分支判断的，判断前可以先 git fetch。结果在 req stats 里看。`;
+
+async function main(argv: string[]): Promise<number> {
+  if (argv.includes("--help") || argv.includes("-h")) {
+    console.log(USAGE);
+    return 0;
+  }
+  const feature = argv.find((a, i) => !a.startsWith("--") && !["--issue", "--commit"].includes(argv[i - 1] ?? ""));
+  const value = (flag: string) => {
+    const i = argv.indexOf(flag);
+    return i >= 0 ? (argv[i + 1] ?? null) : null;
+  };
+  if (!feature) {
+    const added = scanOutcomes();
+    if (added.length === 0) console.log("没有新的合并或合并后问题。");
+    for (const e of added) {
+      console.log(e.kind === "merge" ? `已合并：${e.requirement.title}（${e.merge!.into}${e.merge!.commit ? `，${e.merge!.commit}` : ""}）` : `合并后的问题：${e.requirement.title} ← ${e.issue!.by}「${e.issue!.text}」`);
+    }
+    return 0;
+  }
+  const { locate } = await import("./api.js");
+  const { repo, featureDir } = locate(process.cwd(), feature);
+  const requirement = requirementRef(repo, featureDir);
+  if (argv.includes("--merged")) {
+    appendEvent({ kind: "merge", requirement, merge: { into: mainLine(repo) ?? "main", commit: value("--commit"), mergedAt: null, how: "manual" } });
+    console.log(`已记录：${requirement.title} 已合并。`);
+    return 0;
+  }
+  const text = value("--issue");
+  if (text && !text.startsWith("--")) {
+    appendEvent({ kind: "issue", requirement, issue: { text: text.slice(0, 500), by: null, id: `manual:${Date.now()}` } });
+    console.log(`已记录：${requirement.title} 合并后的问题「${text.slice(0, 80)}」。`);
+    return 0;
+  }
+  console.error(USAGE);
+  return 2;
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(import.meta.filename)) {
+  main(process.argv.slice(2)).then(
+    (code) => process.exit(code),
+    (error: Error) => {
+      console.error(error.message);
+      process.exit(1);
+    },
+  );
+}

package/engine/src/paseo-runtime.ts

@@ -1,5 +1,5 @@
 import type { PaseoAgentHandle, PaseoClient } from "@getpaseo/client";
-import { runningToolOf, summarizeActivity } from "./activity.js";
+import { runningToolOf, toolCallsOf, summarizeActivity } from "./activity.js";
 import { type AgentProfile, isResolved, type PipelineConfig } from "./config.js";
 import { profilesFromDaemonConfig } from "./paseo-profiles.js";
 import { cronAt, localTimeZone } from "./schedule-time.js";
@@ -296,6 +296,14 @@ export function createRuntimeWithClient(
         return null;
       }
     },
+    async toolCalls(agentId) {
+      try {
+        const page = await client.agents.ref(agentId).timeline.refetch({ direction: "tail", limit: 200 });
+        return toolCallsOf(page.entries);
+      } catch {
+        return null;
+      }
+    },
     async createWorktree(request) {
       if (!client.workspaces) throw new Error("这个 Paseo 版本不支持新建工作区");
       const workspace = await client.workspaces.create({