patchwarden 0.6.4 → 1.5.0

package/src/security/toolInvocationGuard.ts

@@ -0,0 +1,251 @@
+/**
+ * v0.8.1: toolInvocationGuard — invoke_discovered_tool 调用前强制校验。
+ *
+ * consumeToken 已完成 token 存在性与过期校验，guard 收到的是已消费的 record。
+ * guard 依次执行 8 项校验，任一失败抛出对应错误码：
+ *   1. token_tool_mismatch       — toolName 与 record.toolName 一致性
+ *   2. profile_not_allowed        — toolMeta.profiles 必须包含当前 profile
+ *   3. risk_exceeded              — toolMeta.risk 不能超过 record.risk（schema 漂移拦截）
+ *   4. sensitive_path_blocked     — workspace_read_sensitive 路径敏感校验
+ *   5. assessment_required        — workspace_write 需要 assessmentId
+ *   6. command_not_allowed        — command 工具 args.command 元字符预检
+ *   7. release_confirmation_required — release 工具需要 assessmentId
+ *   8. credential_sensitive_blocked — credential_sensitive 总是拒绝
+ *
+ * 加上 consumeToken 内的 token_not_found / token_expired，共 10 项调用前强制校验。
+ */
+
+import { PatchWardenError } from "../errors.js";
+import { guardSensitivePath } from "./sensitiveGuard.js";
+import { TOOL_RISK_RANK, type PatchWardenToolMeta } from "../tools/toolRegistry.js";
+import type { ToolProfile } from "../tools/toolCatalog.js";
+import type { DiscoveryTokenRecord } from "./discoveryTokenStore.js";
+
+// ── 类型定义 ──────────────────────────────────────────────────────
+
+export interface GuardInput {
+  toolName: string;                          // 要调用的工具名
+  toolMeta: PatchWardenToolMeta;             // 工具元数据
+  args: Record<string, unknown>;             // 调用参数
+  discoveryTokenRecord: DiscoveryTokenRecord; // token 记录（已 consume）
+  profile: ToolProfile;                      // 当前 profile
+  assessmentId?: string;                     // 可选 assessmentId
+}
+
+export interface GuardResult {
+  allowed: boolean;
+}
+
+// 错误码常量
+export type InvocationErrorCode =
+  | "token_tool_mismatch"
+  | "profile_not_allowed"
+  | "risk_exceeded"
+  | "sensitive_path_blocked"
+  | "assessment_required"
+  | "command_not_allowed"
+  | "release_confirmation_required"
+  | "credential_sensitive_blocked";
+
+// ── 内部常量 ──────────────────────────────────────────────────────
+
+/**
+ * 常见路径参数字段名，用于 workspace_read_sensitive 校验时扫描 args。
+ * 任一字段为字符串路径都会触发 guardSensitivePath。
+ */
+const PATH_ARG_FIELDS = [
+  "path",
+  "file",
+  "filePath",
+  "file_path",
+  "filename",
+  "repo_path",
+  "repoPath",
+  "target_path",
+  "targetPath",
+  "destination",
+  "dest",
+] as const;
+
+/**
+ * shell 元字符黑名单，用于 command 风险工具 args.command 预检。
+ * 真正的白名单校验在 handler 内通过 commandGuard 完成，guard 只做元字符预检。
+ */
+const SHELL_METACHAR_PATTERN = /[|&;`$()<>]/;
+
+// ── 公共 API ──────────────────────────────────────────────────────
+
+/**
+ * 调用前强制校验。任一校验失败抛 PatchWardenError，全部通过返回 { allowed: true }。
+ */
+export function checkInvocation(input: GuardInput): GuardResult {
+  const { toolName, toolMeta, args, discoveryTokenRecord, profile, assessmentId } = input;
+
+  // ① toolName 一致性：toolName 必须等于 record.toolName
+  if (toolName !== discoveryTokenRecord.toolName) {
+    throw new PatchWardenError(
+      "token_tool_mismatch",
+      `Token tool mismatch: token was issued for "${discoveryTokenRecord.toolName}" but invocation targets "${toolName}".`,
+      "Call discover_tools again and use a token issued for the intended tool name.",
+      true,
+      {
+        token: discoveryTokenRecord.token,
+        expected_tool: discoveryTokenRecord.toolName,
+        actual_tool: toolName,
+      }
+    );
+  }
+
+  // ② profile 允许：toolMeta.profiles 必须包含当前 profile
+  if (!toolMeta.profiles.includes(profile)) {
+    throw new PatchWardenError(
+      "profile_not_allowed",
+      `Profile "${profile}" is not allowed for tool "${toolName}". Allowed profiles: ${toolMeta.profiles.join(", ")}.`,
+      "Switch to a profile that exposes this tool, or call discover_tools under a supported profile.",
+      true,
+      {
+        tool: toolName,
+        current_profile: profile,
+        allowed_profiles: toolMeta.profiles,
+      }
+    );
+  }
+
+  // ③ 风险等级校验：toolMeta.risk 不能超过 record.risk
+  //    token record 的 risk 是 discover 时记录的工具 risk，应与 toolMeta.risk 一致。
+  //    如果工具 schema 漂移导致 risk 变了，这里会拦截。
+  const toolRiskRank = TOOL_RISK_RANK[toolMeta.risk];
+  const tokenRiskRank = TOOL_RISK_RANK[discoveryTokenRecord.risk];
+  if (toolRiskRank > tokenRiskRank) {
+    throw new PatchWardenError(
+      "risk_exceeded",
+      `Risk exceeded: tool "${toolName}" risk is "${toolMeta.risk}" (rank ${toolRiskRank}) but discovery token was issued for risk "${discoveryTokenRecord.risk}" (rank ${tokenRiskRank}). Tool schema may have drifted.`,
+      "Call discover_tools again to obtain a fresh token reflecting the current tool risk.",
+      true,
+      {
+        tool: toolName,
+        tool_risk: toolMeta.risk,
+        token_risk: discoveryTokenRecord.risk,
+        tool_risk_rank: toolRiskRank,
+        token_risk_rank: tokenRiskRank,
+      }
+    );
+  }
+
+  // ④ workspace_read_sensitive：检查 args 中的路径参数
+  checkSensitivePaths(toolMeta, toolName, args);
+
+  // ⑤ workspace_write：要求 assessmentId 非空
+  if (toolMeta.risk === "workspace_write") {
+    if (!assessmentId || assessmentId.trim() === "") {
+      throw new PatchWardenError(
+        "assessment_required",
+        `Assessment required: tool "${toolName}" has workspace_write risk and requires a non-empty assessmentId.`,
+        "Run the assessment flow first and pass the resulting assessmentId to invoke_discovered_tool.",
+        true,
+        {
+          tool: toolName,
+          risk: toolMeta.risk,
+        }
+      );
+    }
+  }
+
+  // ⑥ command：args.command 元字符预检
+  if (toolMeta.risk === "command") {
+    checkCommandMetachars(toolMeta, toolName, args);
+  }
+
+  // ⑦ release：要求 assessmentId 非空（二次确认语义）
+  if (toolMeta.risk === "release") {
+    if (!assessmentId || assessmentId.trim() === "") {
+      throw new PatchWardenError(
+        "release_confirmation_required",
+        `Release confirmation required: tool "${toolName}" has release risk and requires a non-empty assessmentId as explicit confirmation.`,
+        "Run the release assessment flow first and pass the resulting assessmentId to confirm the release.",
+        true,
+        {
+          tool: toolName,
+          risk: toolMeta.risk,
+        }
+      );
+    }
+  }
+
+  // ⑧ credential_sensitive：总是拒绝
+  if (toolMeta.risk === "credential_sensitive") {
+    throw new PatchWardenError(
+      "credential_sensitive_blocked",
+      `Credential-sensitive tool "${toolName}" cannot be invoked through invoke_discovered_tool.`,
+      "Use the dedicated credential-handling tooling outside the dynamic invoke path.",
+      true,
+      {
+        tool: toolName,
+        risk: toolMeta.risk,
+      }
+    );
+  }
+
+  return { allowed: true };
+}
+
+// ── 内部校验函数 ──────────────────────────────────────────────────
+
+/**
+ * workspace_read_sensitive 风险工具：扫描 args 中的路径参数字段，
+ * 对每个字符串路径调用 guardSensitivePath（敏感路径会抛 sensitive_path_blocked）。
+ * 没有路径参数则跳过。
+ */
+function checkSensitivePaths(
+  toolMeta: PatchWardenToolMeta,
+  toolName: string,
+  args: Record<string, unknown>
+): void {
+  if (toolMeta.risk !== "workspace_read_sensitive") {
+    return;
+  }
+
+  for (const field of PATH_ARG_FIELDS) {
+    const value = args[field];
+    if (typeof value === "string" && value.length > 0) {
+      // guardSensitivePath 内部会在敏感时抛 PatchWardenError("sensitive_path_blocked", ...)
+      guardSensitivePath(value);
+    }
+  }
+}
+
+/**
+ * command 风险工具：args.command 元字符预检。
+ * - args.command 不存在或为空 → 跳过（handler 内部会再校验）
+ * - 含 shell 元字符 → 抛 command_not_allowed
+ * 真正的白名单校验在 handler 内通过 commandGuard 完成。
+ */
+function checkCommandMetachars(
+  _toolMeta: PatchWardenToolMeta,
+  toolName: string,
+  args: Record<string, unknown>
+): void {
+  const command = args.command;
+  if (command === undefined || command === null) {
+    return;
+  }
+  if (typeof command !== "string") {
+    return;
+  }
+  if (command.trim() === "") {
+    return;
+  }
+
+  if (SHELL_METACHAR_PATTERN.test(command)) {
+    throw new PatchWardenError(
+      "command_not_allowed",
+      `Command not allowed: tool "${toolName}" args.command contains shell metacharacters. Detected pattern in "${command}".`,
+      "Provide a plain command without shell metacharacters (| & ; ` $ ( ) < >). The handler will validate against the command allowlist.",
+      true,
+      {
+        tool: toolName,
+        command,
+      }
+    );
+  }
+}

package/src/smoke-test.ts

@@ -26,7 +26,7 @@ import { resolve, join, dirname } from "node:path";
 import { tmpdir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawnSync } from "node:child_process";
-import { loadConfig, getConfig, reloadConfig } from "./config.js";
+import { loadConfig, getConfig, getTasksDir, reloadConfig } from "./config.js";
 import { savePlan } from "./tools/savePlan.js";
 import { getPlan } from "./tools/getPlan.js";
 import { createTask } from "./tools/createTask.js";
@@ -592,7 +592,7 @@ test("D8b. tool profiles are exact and schema changes alter the manifest hash",
   try {
     process.env.PATCHWARDEN_TOOL_PROFILE = "full";
     const fullTools = getToolDefs();
-    if (fullTools.length !== 30) throw new Error(`Expected 30 full tools, got ${fullTools.length}`);
+    if (fullTools.length !== 64) throw new Error(`Expected 64 full tools, got ${fullTools.length}`);
 
     const coreTools = selectToolsForProfile(fullTools, "chatgpt_core", getConfig().enableDirectProfile);
     const names = coreTools.map((tool) => tool.name);
@@ -1023,6 +1023,11 @@ test("I1. list_tasks returns tasks array", () => {
   mgmtPlanId = savePlan({ title: "Mgmt Test", content: "# Test" }).plan_id;
   mgmtTaskId = createTask({ plan_id: mgmtPlanId, agent: "codex", repo_path: "." }).task_id;
   mgmtTaskId2 = createTask({ plan_id: mgmtPlanId, agent: "codex", repo_path: "." }).task_id;
+  const collectingStatusFile = join(getTasksDir(getConfig()), mgmtTaskId2, "status.json");
+  const collectingStatus = JSON.parse(readFileSync(collectingStatusFile, "utf-8"));
+  collectingStatus.status = "collecting_artifacts";
+  collectingStatus.phase = "collecting_artifacts";
+  writeFileSync(collectingStatusFile, JSON.stringify(collectingStatus, null, 2), "utf-8");
   const result = listTasks({ limit: 5 });
   if (!Array.isArray(result.tasks)) throw new Error("tasks not array");
   if (result.tasks.length < 2) throw new Error(`Expected >=2 tasks, got ${result.tasks.length}`);
@@ -1039,9 +1044,12 @@ test("I2b. list_tasks filters by repo and active status with watcher evidence",
   if (result.returned !== result.tasks.length || !result.watcher?.status) {
     throw new Error(`Missing list_tasks pagination or watcher evidence: ${JSON.stringify(result)}`);
   }
-  if (result.tasks.some((task) => !["pending", "running"].includes(task.status) || task.repo_path !== ".")) {
+  if (result.tasks.some((task) => !["pending", "running", "collecting_artifacts"].includes(task.status) || task.repo_path !== ".")) {
     throw new Error(`list_tasks active/repo filter mismatch: ${JSON.stringify(result.tasks)}`);
   }
+  if (!result.tasks.some((task) => task.task_id === mgmtTaskId2 && task.status === "collecting_artifacts")) {
+    throw new Error(`list_tasks active_only omitted collecting_artifacts task: ${JSON.stringify(result.tasks)}`);
+  }
 });
 
 test("I3. cancel_task cancels pending task", () => {
@@ -1926,10 +1934,10 @@ reloadConfig();
 
 let directSessionId = "";
 
-test("M1. chatgpt_core still has 17 tools", () => {
+test("M1. chatgpt_core still has the expected tool manifest", () => {
   const tools = getToolDefs();
   const coreTools = selectToolsForProfile(tools, "chatgpt_core", true);
-  if (coreTools.length !== 17) throw new Error(`Expected 17, got ${coreTools.length}`);
+  if (coreTools.length !== CHATGPT_CORE_TOOL_NAMES.length) throw new Error(`Expected ${CHATGPT_CORE_TOOL_NAMES.length}, got ${coreTools.length}`);
   if (JSON.stringify(coreTools.map((t) => t.name)) !== JSON.stringify(CHATGPT_CORE_TOOL_NAMES)) {
     throw new Error("Tool names mismatch");
   }
@@ -1942,10 +1950,10 @@ test("M2. chatgpt_direct disabled exposes only health_check", () => {
   if (disabledTools[0].name !== "health_check") throw new Error(`Expected health_check, got ${disabledTools[0].name}`);
 });
 
-test("M3. chatgpt_direct enabled has 10 tools", () => {
+test("M3. chatgpt_direct enabled has 14 tools", () => {
   const tools = getToolDefs();
   const directTools = selectToolsForProfile(tools, "chatgpt_direct", true);
-  if (directTools.length !== 10) throw new Error(`Expected 10, got ${directTools.length}`);
+  if (directTools.length !== CHATGPT_DIRECT_TOOL_NAMES.length) throw new Error(`Expected ${CHATGPT_DIRECT_TOOL_NAMES.length}, got ${directTools.length}`);
   if (JSON.stringify(directTools.map((t) => t.name)) !== JSON.stringify(CHATGPT_DIRECT_TOOL_NAMES)) {
     throw new Error("Tool names mismatch");
   }

package/src/taskRuntime.ts

@@ -8,6 +8,23 @@ export interface TaskRuntimeData {
   current_command: string | null;
   runner_pid?: number;
   child_pid?: number;
+  /**
+   * v0.7.0: ISO timestamp when the child process was spawned.
+   * Used by diagnose_task to detect PID reuse: if a live PID exists but
+   * its start time does not match child_started_at, the OS likely reused the PID.
+   */
+  child_started_at?: string;
+  /**
+   * v0.7.0: ISO timestamp when the task itself started (runner began executing).
+   * Distinct from child_started_at, which records when the agent child process spawned.
+   */
+  task_started_at?: string;
+  /**
+   * v0.7.0: Watcher instance ID that picked up and is executing this task.
+   * Used by diagnose_task to detect orphaned tasks when the current watcher
+   * instance_id differs from the one recorded at task start.
+   */
+  watcher_instance_id?: string;
 }
 
 export function readTaskRuntime(taskDir: string): Partial<TaskRuntimeData> {

package/src/test/unit/acceptance-engine.test.ts

@@ -0,0 +1,261 @@
+import { describe, it } from "node:test";
+import { strict as assert } from "node:assert";
+import {
+  evaluateAcceptance,
+  verdictToStatus,
+  type AcceptanceEvidence,
+} from "../../goal/acceptanceEngine.js";
+import { renderAcceptanceMarkdown } from "../../goal/acceptanceTemplate.js";
+
+// ── Helpers ───────────────────────────────────────────────────────
+
+function makeEvidence(overrides: Partial<AcceptanceEvidence> = {}): AcceptanceEvidence {
+  return {
+    task_id: "task_test_001",
+    task_status: "done_by_agent",
+    result_md_exists: true,
+    result_json_exists: true,
+    verify_json_exists: true,
+    test_log_exists: true,
+    git_diff_exists: true,
+    verify_status: "passed",
+    new_out_of_scope_changes: [],
+    goal: null,
+    scope: null,
+    forbidden: null,
+    verification: null,
+    done_evidence: null,
+    artifact_status: "collected",
+    release_claims_unverified: false,
+    checks: [
+      { name: "task_status", result: "pass", detail: "Task status is done_by_agent." },
+      { name: "result_md_exists", result: "pass", detail: "result.md found." },
+      { name: "verify_status", result: "pass", detail: "Verification passed." },
+    ],
+    ...overrides,
+  };
+}
+
+// ── Tests ─────────────────────────────────────────────────────────
+
+describe("acceptanceEngine", () => {
+
+  describe("evaluateAcceptance — 基础场景", () => {
+
+    it("所有检查通过 → ACCEPTED", () => {
+      const evidence = makeEvidence();
+      const result = evaluateAcceptance(evidence);
+      assert.equal(result.verdict, "ACCEPTED");
+      assert.equal(result.acceptance_status, "accepted");
+      assert.equal(result.fail_checks.length, 0);
+      assert.equal(result.warn_checks.length, 0);
+      assert.ok(result.reason.includes("All acceptance checks passed"));
+    });
+
+    it("存在 fail 级检查项 → REJECTED", () => {
+      const evidence = makeEvidence({
+        checks: [
+          { name: "task_status", result: "pass", detail: "ok" },
+          { name: "result_md_exists", result: "fail", detail: "result.md is missing." },
+          { name: "verify_status", result: "pass", detail: "ok" },
+        ],
+      });
+      const result = evaluateAcceptance(evidence);
+      assert.equal(result.verdict, "REJECTED");
+      assert.equal(result.acceptance_status, "rejected");
+      assert.equal(result.fail_checks.length, 1);
+      assert.equal(result.fail_checks[0].name, "result_md_exists");
+      assert.ok(result.reason.includes("fail-level"));
+    });
+
+    it("存在 warn 级检查项（无 fail）→ NEEDS_FIX", () => {
+      const evidence = makeEvidence({
+        checks: [
+          { name: "task_status", result: "pass", detail: "ok" },
+          { name: "git_diff_exists", result: "warn", detail: "git.diff is missing." },
+          { name: "test_log_exists", result: "warn", detail: "test.log is missing." },
+        ],
+      });
+      const result = evaluateAcceptance(evidence);
+      assert.equal(result.verdict, "NEEDS_FIX");
+      assert.equal(result.acceptance_status, "needs_fix");
+      assert.equal(result.warn_checks.length, 2);
+      assert.ok(result.reason.includes("warn-level"));
+    });
+
+    it("存在 release claims 但无法验证 → BLOCKED_BY_APPROVAL（即使有 warn）", () => {
+      const evidence = makeEvidence({
+        release_claims_unverified: true,
+        checks: [
+          { name: "task_status", result: "pass", detail: "ok" },
+          { name: "release_claims_unverified", result: "warn", detail: "Found release claims." },
+        ],
+      });
+      const result = evaluateAcceptance(evidence);
+      assert.equal(result.verdict, "BLOCKED_BY_APPROVAL");
+      assert.equal(result.acceptance_status, "blocked");
+      assert.ok(result.reason.includes("Release claims"));
+      assert.ok(result.required_evidence.some((e) => e.includes("Verify remote")));
+    });
+
+    it("fail 级检查项优先于 release claims", () => {
+      const evidence = makeEvidence({
+        release_claims_unverified: true,
+        checks: [
+          { name: "task_status", result: "fail", detail: "Task failed." },
+          { name: "release_claims_unverified", result: "warn", detail: "Found release claims." },
+        ],
+      });
+      const result = evaluateAcceptance(evidence);
+      assert.equal(result.verdict, "REJECTED");
+      assert.equal(result.acceptance_status, "rejected");
+    });
+
+    it("多个 fail 级检查项全部收集", () => {
+      const evidence = makeEvidence({
+        checks: [
+          { name: "result_md_exists", result: "fail", detail: "missing" },
+          { name: "verify_status", result: "fail", detail: "failed" },
+          { name: "scope_changes", result: "fail", detail: "out of scope" },
+        ],
+      });
+      const result = evaluateAcceptance(evidence);
+      assert.equal(result.verdict, "REJECTED");
+      assert.equal(result.fail_checks.length, 3);
+    });
+  });
+
+  describe("verdictToStatus", () => {
+    it("ACCEPTED → accepted", () => {
+      assert.equal(verdictToStatus("ACCEPTED"), "accepted");
+    });
+
+    it("REJECTED → rejected", () => {
+      assert.equal(verdictToStatus("REJECTED"), "rejected");
+    });
+
+    it("NEEDS_FIX → needs_fix", () => {
+      assert.equal(verdictToStatus("NEEDS_FIX"), "needs_fix");
+    });
+
+    it("BLOCKED_BY_APPROVAL → blocked", () => {
+      assert.equal(verdictToStatus("BLOCKED_BY_APPROVAL"), "blocked");
+    });
+  });
+
+  describe("evaluateAcceptance — next_suggested_task", () => {
+    it("ACCEPTED 的 next_suggested_task 包含 'accepted'", () => {
+      const result = evaluateAcceptance(makeEvidence());
+      assert.ok(result.next_suggested_task.includes("accepted"));
+    });
+
+    it("REJECTED 的 next_suggested_task 包含 fail 检查名", () => {
+      const result = evaluateAcceptance(makeEvidence({
+        checks: [{ name: "result_md_exists", result: "fail", detail: "missing" }],
+      }));
+      assert.ok(result.next_suggested_task.includes("result_md_exists"));
+    });
+
+    it("NEEDS_FIX 的 next_suggested_task 包含 warn 检查名", () => {
+      const result = evaluateAcceptance(makeEvidence({
+        checks: [{ name: "git_diff_exists", result: "warn", detail: "missing" }],
+      }));
+      assert.ok(result.next_suggested_task.includes("git_diff_exists"));
+    });
+
+    it("BLOCKED_BY_APPROVAL 的 next_suggested_task 包含 'verify'", () => {
+      const result = evaluateAcceptance(makeEvidence({ release_claims_unverified: true }));
+      assert.ok(result.next_suggested_task.toLowerCase().includes("verify"));
+    });
+  });
+
+  describe("evaluateAcceptance — reasons 可追溯", () => {
+    it("REJECTED 的 reasons 包含 [FAIL] 前缀", () => {
+      const result = evaluateAcceptance(makeEvidence({
+        checks: [{ name: "result_md_exists", result: "fail", detail: "missing" }],
+      }));
+      assert.ok(result.reasons.some((r) => r.includes("[FAIL]")));
+    });
+
+    it("NEEDS_FIX 的 reasons 包含 [WARN] 前缀", () => {
+      const result = evaluateAcceptance(makeEvidence({
+        checks: [{ name: "git_diff_exists", result: "warn", detail: "missing" }],
+      }));
+      assert.ok(result.reasons.some((r) => r.includes("[WARN]")));
+    });
+
+    it("BLOCKED_BY_APPROVAL 的 reasons 包含 [BLOCKED] 前缀", () => {
+      const result = evaluateAcceptance(makeEvidence({ release_claims_unverified: true }));
+      assert.ok(result.reasons.some((r) => r.includes("[BLOCKED]")));
+    });
+
+    it("ACCEPTED 的 reasons 非空", () => {
+      const result = evaluateAcceptance(makeEvidence());
+      assert.ok(result.reasons.length > 0);
+    });
+  });
+
+  describe("renderAcceptanceMarkdown", () => {
+    it("生成包含 verdict 的 ACCEPTANCE.md 内容", () => {
+      const evidence = makeEvidence();
+      const result = evaluateAcceptance(evidence);
+      const md = renderAcceptanceMarkdown("task_test_001", result, evidence);
+      assert.ok(md.includes("# Acceptance Report — task_test_001"));
+      assert.ok(md.includes("**ACCEPTED**"));
+      assert.ok(md.includes("## Evidence Summary"));
+      assert.ok(md.includes("## Verdict"));
+    });
+
+    it("REJECTED 的 Markdown 包含 fail 检查", () => {
+      const evidence = makeEvidence({
+        checks: [{ name: "result_md_exists", result: "fail", detail: "missing" }],
+      });
+      const result = evaluateAcceptance(evidence);
+      const md = renderAcceptanceMarkdown("task_test_002", result, evidence);
+      assert.ok(md.includes("**REJECTED**"));
+      assert.ok(md.includes("## Fail-Level Checks"));
+      assert.ok(md.includes("result_md_exists"));
+    });
+
+    it("NEEDS_FIX 的 Markdown 包含 warn 检查", () => {
+      const evidence = makeEvidence({
+        checks: [{ name: "git_diff_exists", result: "warn", detail: "missing" }],
+      });
+      const result = evaluateAcceptance(evidence);
+      const md = renderAcceptanceMarkdown("task_test_003", result, evidence);
+      assert.ok(md.includes("**NEEDS_FIX**"));
+      assert.ok(md.includes("## Warn-Level Checks"));
+    });
+
+    it("BLOCKED 的 Markdown 包含 required_evidence", () => {
+      const evidence = makeEvidence({ release_claims_unverified: true });
+      const result = evaluateAcceptance(evidence);
+      const md = renderAcceptanceMarkdown("task_test_004", result, evidence);
+      assert.ok(md.includes("**BLOCKED_BY_APPROVAL**"));
+      assert.ok(md.includes("## Required Evidence"));
+    });
+
+    it("有 goal/scope 时显示 Task Acceptance Criteria", () => {
+      const evidence = makeEvidence({
+        goal: "Implement feature X",
+        scope: ["src/feature.ts"],
+        forbidden: [".env"],
+        verification: ["npm test"],
+        done_evidence: ["result.md", "test.log"],
+      });
+      const result = evaluateAcceptance(evidence);
+      const md = renderAcceptanceMarkdown("task_test_005", result, evidence);
+      assert.ok(md.includes("## Task Acceptance Criteria"));
+      assert.ok(md.includes("Implement feature X"));
+      assert.ok(md.includes("src/feature.ts"));
+      assert.ok(md.includes(".env"));
+    });
+
+    it("无 goal/scope 时不显示 Task Acceptance Criteria section", () => {
+      const evidence = makeEvidence();
+      const result = evaluateAcceptance(evidence);
+      const md = renderAcceptanceMarkdown("task_test_006", result, evidence);
+      assert.ok(!md.includes("## Task Acceptance Criteria"));
+    });
+  });
+});