paseo-req-kit 1.14.0-beta.4 → 1.14.0

package/engine/src/secret-scan.ts

@@ -0,0 +1,177 @@
+// Secret scan (1.14): before the change leaves the step (quality gate) and before the branch
+// leaves the machine (push), the pipeline looks for keys, tokens and passwords in what the
+// requirement added: the lines its commits added since the base and the changes not yet
+// committed. Well-known key formats are found anywhere; "password = ..." style assignments
+// only outside tests and docs, and not when the value is a placeholder or read from the
+// environment. A line with "req-kit:allow-secret" (or "gitleaks:allow") is skipped.
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { matchesPath } from "./gate.js";
+
+export interface SecretScanSettings {
+  enabled: boolean;
+  /** Files never scanned (paths or globs, e.g. "test/fixtures/**"). */
+  allow: string[];
+}
+
+export interface SecretFinding {
+  file: string;
+  line: number;
+  /** The commit that added it (short), or null for a change not committed yet. */
+  commit: string | null;
+  /** What it looks like, for the person ("私钥", "GitLab 令牌", "口令"). */
+  kind: string;
+  /** The line with the secret masked. */
+  preview: string;
+}
+
+const STRONG: Array<{ re: RegExp; kind: string }> = [
+  { re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY( BLOCK)?-----/, kind: "私钥" },
+  { re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/, kind: "AWS 访问密钥" },
+  { re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{40,}\b/, kind: "GitHub 令牌" },
+  { re: /\bglpat-[A-Za-z0-9_-]{20,}\b/, kind: "GitLab 令牌" },
+  { re: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/, kind: "Slack 令牌" },
+  { re: /\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{24,}\b/, kind: "模型服务的 API 密钥" },
+  { re: /\bAIza[0-9A-Za-z_-]{35}\b/, kind: "Google API 密钥" },
+  { re: /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/, kind: "令牌（JWT）" },
+  { re: /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@'"]+:([^\s@/'"]{4,})@[^\s'"]+/i, kind: "地址里带口令" },
+];
+
+const ASSIGN = /(?:^|[\s"'{(,;])([A-Za-z0-9_.-]*(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|credential)[A-Za-z0-9_.-]*)["']?\s*(?:[:=]|:=|=>)\s*(["'`]?)([^\s"'`,;)}]+)\2/i;
+
+/** Values that are not secrets: placeholders, environment lookups, words, booleans. */
+function placeholder(value: string): boolean {
+  const v = value.trim();
+  if (v.length < 8) return true;
+  if (/[${}<>%]|\(|\[|^\*+$|^x+$|^\.+$/i.test(v)) return true;
+  if (/^(true|false|null|none|undefined|nil|required|optional|string|number|boolean)$/i.test(v)) return true;
+  if (/(change.?me|example|sample|dummy|fake|mock|placeholder|your[_-]?|xxx|todo|redacted|\*\*\*|test|demo|secret|password|token)/i.test(v)) return true;
+  // Code, not a value: a property path or a function name.
+  if (/^[A-Za-z_][\w]*(\.[A-Za-z_][\w]*)+$/.test(v) || /^(process\.env|os\.environ|System\.getenv|env\.)/.test(v)) return true;
+  // A secret has some mix: letters and digits, or symbols.
+  return !(/[A-Za-z]/.test(v) && (/\d/.test(v) || /[^A-Za-z0-9]/.test(v)));
+}
+
+const TEST_OR_DOC = /(^|\/)(tests?|__tests__|spec|specs|fixtures?|mocks?|testdata|examples?|docs?)\/|\.(test|spec)\.[a-z]+$|_test\.go$|Test\.java$|\.(md|txt|rst|adoc)$/i;
+const SKIP_FILE = /(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|Cargo\.lock|go\.sum|poetry\.lock|composer\.lock)$|\.(min\.js|map|svg|png|jpe?g|gif|ico|pdf|zip|jar|woff2?)$/i;
+const ALLOW_MARK = /req-kit:allow-secret|gitleaks:allow/;
+
+function mask(line: string, secret: string): string {
+  const shown = secret.length > 6 ? `${secret.slice(0, 4)}…` : "…";
+  const text = line.replace(secret, shown).trim();
+  return text.length > 140 ? `${text.slice(0, 139)}…` : text;
+}
+
+/** The secret on one added line, if any. */
+export function secretInLine(file: string, line: string): { kind: string; preview: string } | null {
+  if (ALLOW_MARK.test(line)) return null;
+  for (const { re, kind } of STRONG) {
+    const m = re.exec(line);
+    if (m) {
+      if (kind === "地址里带口令" && placeholder(m[1])) continue;
+      return { kind, preview: mask(line, m[1] ?? m[0]) };
+    }
+  }
+  if (TEST_OR_DOC.test(file)) return null;
+  const a = ASSIGN.exec(line);
+  if (a && !placeholder(a[3])) return { kind: "口令或密钥", preview: mask(line, a[3]) };
+  return null;
+}
+
+function git(repo: string, args: string[]): string | null {
+  try {
+    return execFileSync("git", args, { cwd: repo, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 256 * 1024 * 1024, windowsHide: true });
+  } catch {
+    return null;
+  }
+}
+
+/** Added lines of a patch (git log -p / git diff), with the file, the line in the new file and the commit. */
+export function scanPatch(patch: string, allow: string[] = []): SecretFinding[] {
+  const out: SecretFinding[] = [];
+  let commit: string | null = null;
+  let file = "";
+  let line = 0;
+  for (const raw of patch.split("\n")) {
+    const c = /^commit ([0-9a-f]{7,40})$/.exec(raw) ?? /^([0-9a-f]{40})\0?$/.exec(raw);
+    if (c) {
+      commit = c[1].slice(0, 8);
+      continue;
+    }
+    if (raw.startsWith("+++ ")) {
+      file = raw.slice(4).replace(/^b\//, "").trim();
+      continue;
+    }
+    const h = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(raw);
+    if (h) {
+      line = Number(h[1]);
+      continue;
+    }
+    if (!file || file === "/dev/null") continue;
+    if (raw.startsWith("+")) {
+      if (!SKIP_FILE.test(file) && !file.includes("/.pipeline/") && !allow.some((p) => matchesPath(file, p))) {
+        const s = secretInLine(file, raw.slice(1));
+        if (s) out.push({ file, line, commit, ...s });
+      }
+      line += 1;
+    } else if (raw.startsWith(" ")) line += 1;
+  }
+  return out;
+}
+
+/**
+ * Secrets the requirement added since `base`: in its commits (each commit's added lines) and in
+ * changes not committed yet (including new files). Null when it cannot be told (no git, no base).
+ */
+export function scanChange(repo: string, base: string | null, settings: Pick<SecretScanSettings, "allow">): SecretFinding[] | null {
+  if (!base || git(repo, ["rev-parse", "--verify", "--quiet", `${base}^{commit}`]) === null) return null;
+  const history = git(repo, ["log", "-p", "--no-color", "--no-ext-diff", "--format=commit %H", "-U0", `${base}..HEAD`]);
+  if (history === null) return null;
+  const pending = git(repo, ["diff", "--no-color", "--no-ext-diff", "-U0", "HEAD"]) ?? "";
+  const findings = [...scanPatch(history, settings.allow), ...scanPatch(pending, settings.allow)];
+  for (const f of (git(repo, ["ls-files", "--others", "--exclude-standard"]) ?? "").split("\n").map((s) => s.trim()).filter(Boolean)) {
+    if (SKIP_FILE.test(f) || f.includes("/.pipeline/") || settings.allow.some((p) => matchesPath(f, p))) continue;
+    const abs = path.join(repo, f);
+    try {
+      if (fs.statSync(abs).size > 1024 * 1024) continue;
+      const lines = fs.readFileSync(abs, "utf8").split("\n");
+      lines.forEach((l, i) => {
+        const s = secretInLine(f, l);
+        if (s) findings.push({ file: f, line: i + 1, commit: null, ...s });
+      });
+    } catch {
+      /* unreadable: skip */
+    }
+  }
+  // The same line found in a commit and still pending counts once.
+  const seen = new Set<string>();
+  return findings.filter((f) => {
+    const k = `${f.file}:${f.preview}`;
+    if (seen.has(k)) return false;
+    seen.add(k);
+    return true;
+  });
+}
+
+export function describeFinding(f: SecretFinding): string {
+  return `${f.file}:${f.line}（${f.kind}${f.commit ? `，提交 ${f.commit}` : "，还没提交"}）：${f.preview}`;
+}
+
+/** What the step's agent is told when the scan finds something. */
+export function secretFollowUp(input: { findings: SecretFinding[]; base: string; round: number; max: number }): string {
+  const commits = [...new Set(input.findings.map((f) => f.commit).filter((c): c is string => !!c))];
+  return [
+    `流水线在你这一步结束后检查了本需求新增的内容，发现疑似密钥、令牌或口令（第 ${input.round} 次要求处理，最多 ${input.max} 次）：`,
+    "",
+    ...input.findings.slice(0, 30).map((f) => `- ${describeFinding(f)}`),
+    "",
+    "请处理：",
+    "1. 从文件里去掉这些值，改成从配置或环境变量读取（配置示例里只写变量名或占位符，例如 `<your-token>`）。测试需要的值用明显的假数据。",
+    commits.length > 0
+      ? `2. 这些值已经写进了本需求的提交（${commits.join("、")}）。这些提交还没有推送，要把它们从历史里去掉：改好文件后用 \`git commit --fixup=<那个提交>\` 提交，再运行 \`git -c sequence.editor=: rebase -i --autosquash <那个提交>^\`（不会打开编辑器）；只在本需求的分支上做，不要动 ${input.base.slice(0, 8)} 之前的提交。`
+      : "2. 这些值还没有提交，改好文件再提交即可。",
+    "3. 确实不是密钥的（例如示例里的假值），在那一行末尾加注释 `req-kit:allow-secret`。",
+    "4. 在本步骤产物里记一笔：哪些地方、怎么处理的。如果它是真实的密钥，写明\"建议更换这个密钥\"，由人来做。",
+  ].join("\n");
+}

package/engine/src/state.ts

@@ -46,6 +46,32 @@ export type StopKind =
   | "budget"
   | "other";
 
+/** 1.14: a dangerous command a step agent ran or started (contracts/state.md). */
+export interface DangerEvent {
+  at: string;
+  /** The step's key, e.g. "implement". */
+  key: string;
+  stepTitle: string;
+  command: string;
+  label: string;
+  /** Whether it had already finished when it was seen (false: interrupted while running). */
+  ran: boolean;
+  /** The agent and its tool call, so the same call is reported once. */
+  agentId?: string;
+  callId?: string;
+}
+
+/** 1.14: a secret scan after a step that changed code. */
+export interface SecretScanRun {
+  key: string;
+  attempt: number;
+  at: string;
+  findings: import("./secret-scan.js").SecretFinding[];
+  /** How many times the agent was asked to remove them. */
+  fixRounds: number;
+  passed: boolean;
+}
+
 /** Something the pipeline handled by itself (1.12). */
 export interface Recovery {
   at: string;
@@ -118,6 +144,10 @@ export interface PipelineState {
   stopKind?: StopKind | null;
   /** 1.12: what the pipeline handled by itself instead of stopping (retries, waiting longer, a fallback model…). */
   recoveries?: Recovery[];
+  /** 1.14: dangerous commands step agents ran or started (dangerGuard), newest last; at most 50. */
+  dangers?: DangerEvent[];
+  /** 1.14: the latest secret scan of each step that changed code (secretScan), for the review and the report. */
+  secretScans?: SecretScanRun[];
   /** 1.12: the questions a run waiting for the requester (waiting_for_business) asks; cleared when it runs again. */
   pendingQuestions?: string[] | null;
   outcome: string | null;

package/engine/src/stats.ts

@@ -12,7 +12,8 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { type RunRecord, readRuns, runsFile } from "./records.js";
+import { type EventRecord, type RunRecord, readEvents, readRuns, runsFile } from "./records.js";
+import { scanOutcomes } from "./outcomes.js";
 import { STEPS, type StepId } from "./steps.js";
 
 export interface Period {
@@ -91,6 +92,49 @@ export interface RequirementStats {
   requester: string | null;
   /** "<system>:<id>" of that card. */
   card: string | null;
+  /** 1.14: what happened after the runs (events): people's code reviews, acceptance, merge, problems after it. */
+  afterRun: AfterRun;
+}
+
+export interface AfterRun {
+  /** Code reviews in the plugin, and how many sent the change back. */
+  humanReviews: number;
+  sentBack: number;
+  /** The latest review: "approved" or "changes_requested"; null without one. */
+  lastReview: string | null;
+  /** The latest acceptance verdict, and how many acceptances failed. */
+  acceptance: string | null;
+  acceptanceFailed: number;
+  /** When it reached the main line (the merge commit's time, else when it was found); null when not (yet) known. */
+  mergedAt: string | null;
+  /** Problems found after the merge. */
+  issues: number;
+}
+
+const eventKey = (e: { requirement: { project: string; key: string } }) => `${e.requirement.project}\0${e.requirement.key}`;
+
+/** A requirement's events summed up (all of them, not only the period's). */
+export function afterRunOf(events: EventRecord[]): AfterRun {
+  const sorted = [...events].sort((a, b) => a.at.localeCompare(b.at));
+  const reviews = sorted.filter((e) => e.kind === "review" && e.review);
+  const acceptances = sorted.filter((e) => e.kind === "acceptance" && e.acceptance);
+  const merge = sorted.find((e) => e.kind === "merge" && e.merge);
+  return {
+    humanReviews: reviews.length,
+    sentBack: reviews.filter((e) => e.review!.verdict === "changes_requested").length,
+    lastReview: reviews.at(-1)?.review?.verdict ?? null,
+    acceptance: acceptances.at(-1)?.acceptance?.verdict ?? null,
+    acceptanceFailed: acceptances.filter((e) => e.acceptance!.verdict === "不通过").length,
+    mergedAt: merge ? (merge.merge!.mergedAt ?? merge.at) : null,
+    issues: new Set(sorted.filter((e) => e.kind === "issue").map((e) => e.issue?.id ?? e.at)).size,
+  };
+}
+
+/** Events seen twice (merged exports) count once. */
+export function dedupeEvents(events: EventRecord[]): EventRecord[] {
+  const seen = new Map<string, EventRecord>();
+  for (const e of events) seen.set(`${eventKey(e)}\0${e.kind}\0${e.kind === "issue" ? e.issue?.id : e.at}`, e);
+  return [...seen.values()];
 }
 
 function add(a: number | null, b: number | null): number | null {
@@ -147,7 +191,9 @@ export function dedupe(runs: RunRecord[]): RunRecord[] {
 }
 
 /** Per requirement, from all of its runs (sorted by start). */
-export function byRequirement(runs: RunRecord[]): RequirementStats[] {
+export function byRequirement(runs: RunRecord[], events: EventRecord[] = []): RequirementStats[] {
+  const eventsOf = new Map<string, EventRecord[]>();
+  for (const e of events) eventsOf.set(eventKey(e), [...(eventsOf.get(eventKey(e)) ?? []), e]);
   const groups = new Map<string, RunRecord[]>();
   for (const r of runs) {
     const key = `${r.requirement.project}\0${r.requirement.key}`;
@@ -198,6 +244,7 @@ export function byRequirement(runs: RunRecord[]): RequirementStats[] {
       reviewer: last.agents.reviewer,
       requester: last.requirement.requester ?? null,
       card: last.requirement.source ? `${last.requirement.source.system}:${last.requirement.source.id}` : null,
+      afterRun: afterRunOf(eventsOf.get(`${last.requirement.project}\0${last.requirement.key}`) ?? []),
     });
   }
   return out.sort((a, b) => b.lastEndedAt.localeCompare(a.lastEndedAt));
@@ -253,11 +300,64 @@ export interface StatsSummary {
     /** recovered / (recovered + interrupted). */
     autoRecoveryShare: number | null;
   };
+  /** 1.14: people's checks and what happened after the runs, from the period's events. */
+  oversight: Oversight;
   /** Requirements that started from cards, by who asked for them (1.10); empty when there are none. */
   byRequester: Array<{ requester: string; requirements: number; completed: number; medianCycleHours: number | null }>;
   requirements: RequirementStats[];
 }
 
+export interface Oversight {
+  /** Code reviews in the plugin: how many, of how many requirements, sent back, passed at the first review. */
+  reviews: { total: number; requirements: number; sentBack: number; passedFirstTime: number; items: number };
+  /** Acceptances on the checklist page. */
+  acceptance: { total: number; requirements: number; failed: number; passedFirstTime: number };
+  /** Requirements that reached the main line, and hours from completion to the merge (median). */
+  merged: { requirements: number; medianHoursAfterCompletion: number | null };
+  /** Problems found after the merge, and of how many requirements. */
+  issues: { total: number; requirements: number };
+}
+
+/** The period's events summed up; "first time" looks at each requirement's first event of the kind (any time). */
+export function oversightOf(events: EventRecord[], period: Period, reqs: RequirementStats[]): Oversight {
+  const inP = events.filter((e) => inPeriod(e.at, period));
+  const of = (kind: EventRecord["kind"]) => inP.filter((e) => e.kind === kind);
+  const firsts = (kind: EventRecord["kind"]) => {
+    const m = new Map<string, EventRecord>();
+    for (const e of [...events].filter((x) => x.kind === kind).sort((a, b) => a.at.localeCompare(b.at))) if (!m.has(eventKey(e))) m.set(eventKey(e), e);
+    return [...m.values()].filter((e) => inPeriod(e.at, period));
+  };
+  const reviews = of("review");
+  const acceptances = of("acceptance");
+  const merges = of("merge");
+  const issues = of("issue");
+  const completed = new Map(reqs.map((q) => [`${q.project}\0${q.key}`, q.completedAt ?? q.lastEndedAt]));
+  const lags = merges.flatMap((e) => {
+    const done = completed.get(eventKey(e));
+    const at = e.merge?.mergedAt ?? e.at;
+    if (!done) return [];
+    const h = (new Date(at).getTime() - new Date(done).getTime()) / 3600_000;
+    return Number.isFinite(h) && h >= 0 ? [round1(h)] : [];
+  });
+  return {
+    reviews: {
+      total: reviews.length,
+      requirements: new Set(reviews.map(eventKey)).size,
+      sentBack: reviews.filter((e) => e.review?.verdict === "changes_requested").length,
+      passedFirstTime: firsts("review").filter((e) => e.review?.verdict === "approved").length,
+      items: reviews.reduce((n, e) => n + (e.review?.items ?? 0), 0),
+    },
+    acceptance: {
+      total: acceptances.length,
+      requirements: new Set(acceptances.map(eventKey)).size,
+      failed: acceptances.filter((e) => e.acceptance?.verdict === "不通过").length,
+      passedFirstTime: firsts("acceptance").filter((e) => e.acceptance?.verdict === "通过").length,
+    },
+    merged: { requirements: new Set(merges.map(eventKey)).size, medianHoursAfterCompletion: median(lags) },
+    issues: { total: new Set(issues.map((e) => e.issue?.id ?? e.at)).size, requirements: new Set(issues.map(eventKey)).size },
+  };
+}
+
 export interface TokenBreakdown {
   /** Input + output of the period's steps that reported usage; null when none did. */
   total: number | null;
@@ -319,9 +419,10 @@ export function tokenBreakdown(steps: RunRecord["steps"], done: RequirementStats
 }
 
 /** The summary of a period from run records (any machines). */
-export function summarizeRuns(all: RunRecord[], period: Period): StatsSummary {
+export function summarizeRuns(all: RunRecord[], period: Period, allEvents: EventRecord[] = []): StatsSummary {
   const runs = dedupe(all);
-  const reqs = byRequirement(runs);
+  const events = dedupeEvents(allEvents);
+  const reqs = byRequirement(runs, events);
   const periodRuns = runs.filter((r) => inPeriod(r.run.endedAt, period));
   const activeKeys = new Set(periodRuns.map((r) => `${r.requirement.project}\0${r.requirement.key}`));
   const active = reqs.filter((q) => activeKeys.has(`${q.project}\0${q.key}`));
@@ -420,6 +521,7 @@ export function summarizeRuns(all: RunRecord[], period: Period): StatsSummary {
       interrupted,
       autoRecoveryShare: recoveredTotal + interrupted === 0 ? null : Math.round((recoveredTotal / (recoveredTotal + interrupted)) * 100) / 100,
     },
+    oversight: oversightOf(events, period, reqs),
     byRequester: [...requesters.entries()]
       .map(([requester, qs]) => {
         const finished = qs.filter((q) => done.includes(q));
@@ -501,6 +603,18 @@ export function describeStats(s: StatsSummary): string {
     `- 需要缺陷修复的需求占比：${s.rework.withDefectRounds === null ? "无数据" : `${Math.round(s.rework.withDefectRounds * 100)}%`}`,
     `- 质量门：运行 ${s.rework.gateRuns} 次，其中发现新失败 ${s.rework.gateFailed} 次`,
   );
+  const o = s.oversight;
+  if (o.reviews.total + o.acceptance.total + o.merged.requirements + o.issues.total > 0) {
+    lines.push(
+      "",
+      "## 人工把关和合并后",
+      "",
+      `- 人工代码评审：${o.reviews.total} 次（${o.reviews.requirements} 个需求），退回修改 ${o.reviews.sentBack} 次、共 ${o.reviews.items} 条意见；第一次评审就通过的需求 ${o.reviews.passedFirstTime} 个`,
+      `- 需求方验收：${o.acceptance.total} 次（${o.acceptance.requirements} 个需求），不通过 ${o.acceptance.failed} 次；第一次验收就通过的需求 ${o.acceptance.passedFirstTime} 个`,
+      `- 合并进主干：${o.merged.requirements} 个需求${o.merged.medianHoursAfterCompletion === null ? "" : `，完成到合并中位数 ${o.merged.medianHoursAfterCompletion} 小时`}`,
+      `- 合并后发现的问题：${o.issues.total} 个（${o.issues.requirements} 个需求）${o.merged.requirements > 0 ? `，按合并的需求算 ${Math.round((o.issues.requirements / o.merged.requirements) * 100)}%` : ""}`,
+    );
+  }
   const RECOVERY_LABELS: Record<string, string> = {
     retry: "临时错误重试",
     reattach: "接着等还在做的 agent",
@@ -537,16 +651,22 @@ export function describeStats(s: StatsSummary): string {
     lines.push("", "## 从卡片开始的需求（按需求方）", "", "| 需求方 | 需求数 | 已完成 | 周期中位数 |", "| --- | --- | --- | --- |");
     for (const r of s.byRequester) lines.push(`| ${r.requester} | ${r.requirements} | ${r.completed} | ${r.medianCycleHours === null ? "-" : `${r.medianCycleHours} 小时`} |`);
   }
-  lines.push("", "## 需求", "", "| 项目 | 需求 | 类型 | 状态 | 周期 | agent 用时 | 评审轮数 | 缺陷轮数 |", "| --- | --- | --- | --- | --- | --- | --- | --- |");
+  lines.push("", "## 需求", "", "| 项目 | 需求 | 类型 | 状态 | 周期 | agent 用时 | 评审轮数 | 缺陷轮数 | 人工评审 | 验收 | 合并 | 合并后问题 |", "| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |");
   for (const q of s.requirements) {
     const status = q.status === "completed" ? (OUTCOME_LABELS[q.outcome ?? "unknown"] ?? "已完成") : (STATUS_LABELS[q.status] ?? q.status);
     lines.push(
-      `| ${q.project} | ${q.title.replace(/\|/g, "／")} | ${TYPE_LABELS[q.type ?? "normal"] ?? q.type} | ${status} | ${q.cycleHours === null ? "-" : `${q.cycleHours} 小时`} | ${hours(q.agentMinutes)} | ${q.reviewRounds} | ${q.defectRounds} |`,
+      `| ${q.project} | ${q.title.replace(/\|/g, "／")} | ${TYPE_LABELS[q.type ?? "normal"] ?? q.type} | ${status} | ${q.cycleHours === null ? "-" : `${q.cycleHours} 小时`} | ${hours(q.agentMinutes)} | ${q.reviewRounds} | ${q.defectRounds} | ${reviewText(q.afterRun)} | ${q.afterRun.acceptance ?? "-"} | ${q.afterRun.mergedAt ? q.afterRun.mergedAt.slice(0, 10) : "-"} | ${q.afterRun.issues || "-"} |`,
     );
   }
   return lines.join("\n");
 }
 
+function reviewText(a: AfterRun): string {
+  if (a.humanReviews === 0) return "-";
+  const last = a.lastReview === "approved" ? "通过" : "退回";
+  return a.sentBack > 0 ? `${last}（退回 ${a.sentBack} 次）` : last;
+}
+
 const CSV_COLUMNS: Array<[string, (q: RequirementStats) => unknown]> = [
   ["project", (q) => q.project],
   ["name", (q) => q.name],
@@ -575,6 +695,13 @@ const CSV_COLUMNS: Array<[string, (q: RequirementStats) => unknown]> = [
   ["reviewer", (q) => q.reviewer ?? ""],
   ["requester", (q) => q.requester ?? ""],
   ["card", (q) => q.card ?? ""],
+  ["human_reviews", (q) => q.afterRun.humanReviews],
+  ["human_sent_back", (q) => q.afterRun.sentBack],
+  ["last_human_review", (q) => q.afterRun.lastReview ?? ""],
+  ["acceptance", (q) => q.afterRun.acceptance ?? ""],
+  ["acceptance_failed", (q) => q.afterRun.acceptanceFailed],
+  ["merged_at", (q) => q.afterRun.mergedAt ?? ""],
+  ["issues_after_merge", (q) => q.afterRun.issues],
 ];
 
 function csvCell(v: unknown): string {
@@ -640,17 +767,24 @@ export function statsMain(argv: string[], env: NodeJS.ProcessEnv = process.env,
   const sources = a.merge.length > 0 ? a.merge.map((f) => path.resolve(cwd, f)) : [runsFile(env)];
   // This machine may have no records yet (nothing ran since 1.9): an empty summary. Named files must exist.
   if (a.merge.length > 0) for (const f of sources) if (!fs.existsSync(f)) throw new Error(`没有这个文件：${f}`);
+  // 1.14: merges and post-merge problems this machine can see, before reading the records.
+  if (a.merge.length === 0) scanOutcomes(env);
   const runs = sources.flatMap((f) => readRuns(f));
+  const events = sources.flatMap((f) => readEvents(f));
 
   if (a.export) {
     const picked = dedupe(runs).filter((r) => inPeriod(r.run.endedAt, period));
+    // Events of the requirements exported (any time, so first reviews count right), and the period's others.
+    const keys = new Set(picked.map((r) => `${r.requirement.project}\0${r.requirement.key}`));
+    const pickedEvents = dedupeEvents(events).filter((e) => keys.has(`${e.requirement.project}\0${e.requirement.key}`) || inPeriod(e.at, period));
     const file = path.resolve(cwd, a.export === true ? `req-kit-usage-${os.hostname()}-${stamp()}.jsonl` : a.export);
-    fs.writeFileSync(file, picked.map((r) => JSON.stringify(r)).join("\n") + (picked.length ? "\n" : ""));
-    console.log(`已导出 ${picked.length} 条运行记录（${period.label}）：${file}\n汇总多台机器：req stats --merge <各机器导出的文件> --report`);
+    const lines = [...picked, ...pickedEvents].map((r) => JSON.stringify(r));
+    fs.writeFileSync(file, lines.join("\n") + (lines.length ? "\n" : ""));
+    console.log(`已导出 ${picked.length} 条运行记录和 ${pickedEvents.length} 条评审、验收、合并记录（${period.label}）：${file}\n汇总多台机器：req stats --merge <各机器导出的文件> --report`);
     return 0;
   }
 
-  const summary = summarizeRuns(runs, period);
+  const summary = summarizeRuns(runs, period, events);
   if (a.report) {
     const dir = path.resolve(cwd, a.out ?? ".");
     fs.mkdirSync(dir, { recursive: true });

package/engine/src/watchdog.ts

@@ -7,6 +7,8 @@
 import fs from "node:fs";
 import path from "node:path";
 import { kitHome } from "./locations.js";
+import { developedIn } from "./features.js";
+import { isSpecConfirmed } from "./preflight.js";
 import { readIndex } from "./records.js";
 import { isAlive, readState, statePath, writeState } from "./state.js";
 
@@ -25,6 +27,8 @@ interface Memory {
   by?: string;
   /** Per requirement: the dead process already handled, and when continuations happened. */
   handled?: Record<string, { pid: number; times: string[] }>;
+  /** 1.14: requirements whose chat was reminded that a confirmed spec has not started (once each). */
+  reminded?: Record<string, string>;
 }
 
 function readMemory(env: NodeJS.ProcessEnv): Memory {
@@ -57,21 +61,51 @@ export interface WatchdogResult {
   resumed: Array<{ featureDir: string; repo: string; message: string }>;
   failed: Array<{ featureDir: string; repo: string; message: string }>;
   skipped: Array<{ featureDir: string; reason: string }>;
+  /** 1.14: chats reminded that their confirmed requirement has not started. */
+  reminded: Array<{ featureDir: string; repo: string; ok: boolean; message: string }>;
+}
+
+/** 1.14: a confirmed spec with no run gets a reminder in its chat after this long, once. */
+export const REMIND_NOT_STARTED_MS = 30 * 60_000;
+/** Older confirmations are not reminded (e.g. right after an upgrade). */
+const REMIND_WITHIN_MS = 3 * 24 * 3600_000;
+
+/** A requirement confirmed a while ago with no run and nothing developed: since when (the spec's last change). */
+function confirmedNotStarted(repo: string, featureDir: string): number | null {
+  const dir = path.join(repo, featureDir);
+  const spec = path.join(dir, "spec.md");
+  try {
+    if (!isSpecConfirmed(fs.readFileSync(spec, "utf8")) || developedIn(dir)) return null;
+    return fs.statSync(spec).mtimeMs;
+  } catch {
+    return null;
+  }
 }
 
 export type Resume = (repo: string, featureDir: string) => { ok: boolean; message: string };
 
-export function watchdogPass(input: { env?: NodeJS.ProcessEnv; by: "plugin" | "factory" | "manual"; resume: Resume; now?: Date; dryRun?: boolean }): WatchdogResult {
+export function watchdogPass(input: { env?: NodeJS.ProcessEnv; by: "plugin" | "factory" | "manual"; resume: Resume; remind?: Resume; now?: Date; dryRun?: boolean }): WatchdogResult {
   const env = input.env ?? process.env;
   const now = input.now ?? new Date();
   const memory = readMemory(env);
   const handled = memory.handled ?? {};
-  const result: WatchdogResult = { checked: 0, resumed: [], failed: [], skipped: [] };
+  const reminded = memory.reminded ?? {};
+  const result: WatchdogResult = { checked: 0, resumed: [], failed: [], skipped: [], reminded: [] };
   for (const entry of readIndex(env)) {
     if (!entry.present) continue;
     const file = statePath(entry.repo, entry.featureDir);
     const state = readState(file);
-    if (!state) continue;
+    if (!state) {
+      // 1.14: confirmed, never started: remind the chat it was aligned in, once.
+      const since = input.remind && entry.chatAgentId && !reminded[entry.key] ? confirmedNotStarted(entry.repo, entry.featureDir) : null;
+      const age = since === null ? -1 : now.getTime() - since;
+      if (since !== null && age >= REMIND_NOT_STARTED_MS && age < REMIND_WITHIN_MS && !input.dryRun) {
+        const r = input.remind!(entry.repo, entry.featureDir);
+        reminded[entry.key] = now.toISOString();
+        result.reminded.push({ featureDir: entry.featureDir, repo: entry.repo, ok: r.ok, message: r.message.split("\n").find((l) => l.trim()) ?? "" });
+      }
+      continue;
+    }
     result.checked++;
     if (state.status !== "running" || isAlive(state.pid)) continue;
     if (now.getTime() - new Date(state.updatedAt).getTime() < SETTLE_MS) continue;
@@ -100,6 +134,6 @@ export function watchdogPass(input: { env?: NodeJS.ProcessEnv; by: "plugin" | "f
     handled[entry.key] = { pid: state.pid, times: [...recent, now.toISOString()] };
     (r.ok ? result.resumed : result.failed).push({ featureDir: entry.featureDir, repo: entry.repo, message: r.message.split("\n").find((l) => l.trim()) ?? "" });
   }
-  writeMemory(env, { at: now.toISOString(), by: input.by === "manual" ? (memory.by ?? "manual") : input.by, handled });
+  writeMemory(env, { at: now.toISOString(), by: input.by === "manual" ? (memory.by ?? "manual") : input.by, handled, reminded });
   return result;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paseo-req-kit",
-  "version": "1.14.0-beta.4",
+  "version": "1.14.0",
   "description": "req-kit: a requirement-development workflow for Paseo. /req aligns a requirement in chat; the engine runs design, implementation, review and verification as Paseo agents.",
   "type": "module",
   "license": "MIT",

package/paseo-plugin/client/stats.tsx

@@ -91,6 +91,21 @@ export function StatsScreen({ theme, layout }: PluginScreenProps) {
               {card("agent 合计用时", minutes(d.usage.agentMinutes), `输入 ${tokens(d.usage.inputTokens)}，输出 ${tokens(d.usage.outputTokens)} tokens`)}
               {d.usage.costUsd !== null ? card("费用", `$${d.usage.costUsd.toFixed(2)}`) : null}
             </View>
+            {d.oversight && d.oversight.reviews.total + d.oversight.acceptance.total + d.oversight.merged.requirements + d.oversight.issues.total > 0 ? (
+              <View style={s.card}>
+                <Text style={s.heading}>人工把关和合并后</Text>
+                <Text style={s.text}>
+                  人工代码评审 {d.oversight.reviews.total} 次（{d.oversight.reviews.requirements} 个需求），退回修改 {d.oversight.reviews.sentBack} 次；第一次就通过 {d.oversight.reviews.passedFirstTime} 个
+                </Text>
+                <Text style={s.text}>
+                  需求方验收 {d.oversight.acceptance.total} 次，不通过 {d.oversight.acceptance.failed} 次；第一次就通过 {d.oversight.acceptance.passedFirstTime} 个
+                </Text>
+                <Text style={s.text}>
+                  合并进主干 {d.oversight.merged.requirements} 个需求
+                  {d.oversight.merged.medianHoursAfterCompletion === null ? "" : `，完成到合并中位数 ${d.oversight.merged.medianHoursAfterCompletion} 小时`}；合并后发现问题 {d.oversight.issues.total} 个
+                </Text>
+              </View>
+            ) : null}
             {d.tokens?.total ? <TokenShare theme={theme} compact={layout.compact} t={d.tokens} /> : null}
             {d.waits.length > 0 ? (
               <View style={s.card}>

package/paseo-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "req-kit-paseo-plugin",
-  "version": "1.14.0-beta.4",
+  "version": "1.14.0",
   "private": true,
   "description": "The req-kit plugin for Paseo. Ships inside the paseo-req-kit package; installed with req plugin install.",
   "type": "module",

package/paseo-plugin/shared/contracts.ts

@@ -130,6 +130,13 @@ export interface StatsSummary {
     rework: { tokens: number; share: number } | null;
     perRequirement: { median: number | null; byProfile: Array<{ profile: string; requirements: number; median: number | null }> };
   };
+  /** req-kit 1.14+: people's code reviews, acceptance, merges and problems after them. */
+  oversight?: {
+    reviews: { total: number; requirements: number; sentBack: number; passedFirstTime: number; items: number };
+    acceptance: { total: number; requirements: number; failed: number; passedFirstTime: number };
+    merged: { requirements: number; medianHoursAfterCompletion: number | null };
+    issues: { total: number; requirements: number };
+  };
 }
 
 export interface KitInfo {