pi-skill-evolve 0.0.0-stage → 0.1.0

package/extensions/skill-evolve/test/web-render.test.ts

@@ -0,0 +1,300 @@
+/** 只读面板的服务端渲染：HTML 转义（技能正文里可能有 <script>）、各视图标题与空态、状态栏数字。 */
+import assert from "node:assert/strict";
+import test from "node:test";
+import type { WebState } from "../lib/web/data.ts";
+import { escapeHtml, formatStamp, parseView, renderPage } from "../lib/web/render.ts";
+
+function withApproval(): WebState {
+  const state = emptyState();
+  state.approvals.push({
+    runId: "run-a",
+    skill: "demo",
+    level: "approval",
+    targets: [".pi/skills/demo/SKILL.md"],
+    createdAt: new Date(2026, 10, 8, 12).getTime(),
+    proposal: { type: "improve", added: 3, removed: 1 },
+    review: { verdict: "pass", blocking: 0 },
+    detail: "",
+  });
+  return state;
+}
+
+function emptyState(): WebState {
+  return {
+    pending: [],
+    approvals: [],
+    applied: [],
+    done: [],
+    reports: [],
+    summary: { reviewing: 0, stale: 0, pendingApprovals: 0, appliedTotal: 0, rollbackRate: 0 },
+  };
+}
+
+function withPending(head: string, detail: string): WebState {
+  const state = emptyState();
+  state.pending.push({ runId: "run-x", kind: "approval", skill: head, at: 0, detail });
+  return state;
+}
+
+test("escapeHtml：五个字符全转，且 & 先转", () => {
+  assert.equal(escapeHtml(`& < > " '`), "&amp; &lt; &gt; &quot; &#39;");
+  assert.equal(escapeHtml("<script>alert(1)</script>"), "&lt;script&gt;alert(1)&lt;/script&gt;");
+  assert.equal(escapeHtml("a&amp;b"), "a&amp;amp;b", "已转义文本再转一次也不会被二次解码");
+});
+
+test("渲染：技能名与详情里的 <script> 一律转义，页面里没有裸 <script>", () => {
+  const html = renderPage(withPending("<script>alert(1)</script>", "证据：<script>x()</script>"), "pending");
+  assert.equal(/<script/i.test(html), false, "不能出现裸 <script>");
+  assert.match(html, /&lt;script&gt;alert\(1\)&lt;\/script&gt;/);
+  assert.match(html, /&lt;script&gt;x\(\)&lt;\/script&gt;/);
+});
+
+test("渲染：findings 里的 HTML 也被转义（报告页同样不可注入）", () => {
+  const state = emptyState();
+  state.reports.push({
+    runId: "run-1",
+    status: "applied",
+    trigger: "auto",
+    startedAt: 0,
+    findings: { total: 1, rows: [{ skill: "<img src=x onerror=alert(1)>", kind: "未加载", reason: "<b>没读</b>" }] },
+    proposal: { type: "improve", skill: "demo", added: 3, removed: 1 },
+    review: { status: "reviewed", verdict: "pass", blocking: 0 },
+    decision: { status: "applied", approver: "auto", at: 0, detail: "<script>d</script>" },
+    verify: { status: "applied", at: 0, gates: [{ gate: "gate0", name: "授权核对", ok: true }] },
+  });
+  const html = renderPage(state, "reports");
+  assert.equal(/<img/i.test(html), false);
+  assert.equal(/<script/i.test(html), false);
+  assert.match(html, /&lt;img src=x onerror=alert\(1\)&gt;/);
+});
+
+test("四个视图：标题、active 标签与列表内容各就各位", () => {
+  const state = withPending("demo", "详情");
+  const pending = renderPage(state, "pending");
+  assert.match(pending, /<title>技能进化 · 待处理<\/title>/);
+  assert.match(pending, /<a href="\/\?view=pending" class="active">待处理<\/a>/);
+  assert.match(pending, /\[待批\] run-x · demo/);
+
+  const approvals = renderPage(withApproval(), "approvals");
+  assert.match(approvals, /<title>技能进化 · 待审批<\/title>/);
+  assert.match(approvals, /<a href="\/\?view=approvals" class="active">待审批<\/a>/);
+  assert.equal(approvals.includes("run-x"), false, "待审批页只收 approvals，不串待处理条目");
+
+  const done = renderPage(state, "done");
+  assert.match(done, /<title>技能进化 · 已处理<\/title>/);
+  assert.match(done, /<a href="\/\?view=done" class="active">已处理<\/a>/);
+  assert.equal(done.includes("[待批] run-x"), false, "别的视图不能串内容");
+
+  const reports = renderPage(state, "reports");
+  assert.match(reports, /<title>技能进化 · 复盘报告<\/title>/);
+  assert.match(reports, /<a href="\/\?view=reports" class="active">复盘报告<\/a>/);
+});
+
+test("六个视图：tab 顺序是 待处理 / 待审批 / 已采纳 / 已处理 / 复盘报告 / 技能管理", () => {
+  const html = renderPage(emptyState(), "pending");
+  // 只扫 nav：状态栏与页脚里也有 /?view=approvals 链接，整页扫会把它们算进来
+  const nav = html.slice(html.indexOf("<nav>"), html.indexOf("</nav>"));
+  const order = [...nav.matchAll(/<a href="\/\?view=(\w+)"/g)].map((match) => match[1]);
+  assert.deepEqual(order, ["pending", "approvals", "applied", "done", "reports", "skills"]);
+});
+
+test("空态：每个列表视图各有一句人话", () => {
+  for (const [view, text] of [
+    ["pending", "暂无待处理：所有复盘都已完成，也没有待人批的改动。"],
+    ["approvals", "没有待批：auto 级不需要人批，approval 级的会出现在这里。"],
+    ["applied", "还没有已采纳的提案：采纳过的会连 diff 一起留在这里。"],
+    ["done", "暂无已处理记录：还没有回滚、失败或被否决的提案。"],
+    ["reports", "暂无复盘报告：还没有 run 写过 01-findings.json。"],
+  ] as const) {
+    const html = renderPage(emptyState(), view);
+    assert.match(html, new RegExp(text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")));
+    assert.equal(html.includes("<ul>"), false, `${view} 空态不该有列表`);
+  }
+});
+
+test("状态栏：五个数字按顺序，回滚率取整百分比，待批数字链到待审批页", () => {
+  const state = emptyState();
+  state.summary = { reviewing: 2, stale: 1, pendingApprovals: 3, appliedTotal: 4, rollbackRate: 0.256 };
+  const html = renderPage(state, "pending");
+  assert.match(
+    html,
+    /复盘中 2 · 卡死 1 · 待批 <a href="\/\?view=approvals">3<\/a> · 已采纳 <a href="\/\?view=applied">4<\/a> · 回滚率 26%/,
+  );
+});
+
+test("报告详情：findings 条数、提案增删行、五闸对错都在展开区里", () => {
+  const state = emptyState();
+  state.reports.push({
+    runId: "run-2",
+    status: "applied",
+    trigger: "manual",
+    startedAt: 0,
+    findings: { total: 7, rows: [{ skill: "demo", kind: "未加载", reason: "B frontmatter 坏" }] },
+    proposal: { type: "improve", skill: "demo", added: 5, removed: 2 },
+    review: { status: "reviewed", verdict: "pass", blocking: 1 },
+    decision: null,
+    verify: {
+      status: "applied",
+      at: 0,
+      gates: [
+        { gate: "gate0", name: "授权核对", ok: true },
+        { gate: "gate3", name: "诊断", ok: false },
+      ],
+    },
+  });
+  const html = renderPage(state, "reports");
+  assert.match(html, /findings：7 条/);
+  assert.match(html, /…另有 6 条（见 01-findings\.json）/);
+  assert.match(html, /提案：improve demo \+5\/-2/);
+  assert.match(html, /blocking 1 条/);
+  assert.match(html, /决策：未采纳（没有 04-decision\.json）/);
+  assert.match(html, /gate0✓ gate3✗/);
+});
+
+test("页脚写清只读与采纳入口", () => {
+  const html = renderPage(emptyState(), "pending");
+  assert.match(html, /只读面板/);
+  assert.match(html, /\/skill-evolve approve &lt;runId&gt;/);
+  assert.match(html, /href="\/api\/state"/);
+});
+
+test("parseView：认 approvals / done / reports，其余回落待处理", () => {
+  assert.equal(parseView("approvals"), "approvals");
+  assert.equal(parseView("done"), "done");
+  assert.equal(parseView("reports"), "reports");
+  assert.equal(parseView("pending"), "pending");
+  assert.equal(parseView(null), "pending");
+  assert.equal(parseView("bogus"), "pending");
+});
+
+test("formatStamp：null 给破折号，时间按本地 YYYY-MM-DD HH:mm", () => {
+  assert.equal(formatStamp(null), "—");
+  assert.equal(formatStamp(new Date(2026, 10, 8, 9, 5).getTime()), "2026-11-08 09:05");
+});
+
+test("待处理页：5 秒自刷新只加在这一页，且刷完还在待处理", () => {
+  const state = emptyState();
+  assert.match(renderPage(state, "pending"), /<meta http-equiv="refresh" content="5; url=\?view=pending">/);
+  assert.equal(renderPage(state, "done").includes('http-equiv="refresh"'), false, "看档案时刷新会把页面跳回去");
+  assert.equal(renderPage(state, "reports").includes('http-equiv="refresh"'), false);
+});
+
+test("待处理页：运行中的条目有自己的徽章，不是只给个数字", () => {
+  const state = emptyState();
+  state.pending.push({ runId: "run-live", kind: "running", skill: "", at: 0, detail: "阶段：复盘产出中" });
+  const html = renderPage(state, "pending");
+  assert.match(html, /\[进行中\] run-live/);
+});
+
+test("复盘报告：卡死的 run 行首标 [卡死]，detail 里带失败原因", () => {
+  const state = emptyState();
+  state.reports.push({
+    runId: "run-dead",
+    status: "stale",
+    trigger: "auto",
+    startedAt: 0,
+    findings: { total: 0, rows: [] },
+    proposal: null,
+    review: null,
+    decision: null,
+    verify: null,
+    failure: "原因：子进程已退出\n日志末行：Error: 模板缺失",
+  });
+  const html = renderPage(state, "reports");
+  assert.match(html, /\[卡死\] <a class="run" href="\/\?view=run&amp;runId=run-dead">run-dead<\/a>/);
+  assert.match(html, /原因：子进程已退出/);
+  assert.match(html, /日志末行：Error: 模板缺失/);
+});
+
+test("待审批页：条目上是 targets / 提案增删行 / verdict 与 blocking 条数", () => {
+  const html = renderPage(withApproval(), "approvals");
+  assert.match(html, /\[approval\] run-a · demo · improve \+3\/-1 · pass\/blocking 0/);
+  assert.match(html, /目标：\.pi\/skills\/demo\/SKILL\.md/);
+  assert.match(html, /提案：improve \+3\/-1 行/);
+  assert.match(html, /评审：verdict=pass · blocking 0 条/);
+  assert.match(html, /runId：run-a/, "详情第一行是完整 runId");
+});
+
+test("待审批页：注入回调 + csrf 时渲染批准与拒绝表单，csrf 与 runId 都是 hidden", () => {
+  const html = renderPage(withApproval(), "approvals", { canWrite: true, csrf: "tok-123" });
+  assert.match(html, /<form method="post" action="\/approve">/);
+  assert.match(html, /<form method="post" action="\/reject">/);
+  assert.equal(html.match(/name="csrf" value="tok-123"/g)?.length, 2, "两个表单各带一份 csrf");
+  assert.equal(html.match(/name="runId" value="run-a"/g)?.length, 2, "两个表单各带一份 runId");
+  assert.match(html, />批准</);
+  assert.match(html, />拒绝</);
+});
+
+test("待审批页：没注入回调（canWrite 缺省）不渲染按钮，页脚写「本实例只读」", () => {
+  const html = renderPage(withApproval(), "approvals");
+  assert.equal(html.includes("<form"), false, "只读实例不能出现任何表单");
+  assert.equal(html.includes("/approve"), false, "连 action 都不该出现");
+  assert.match(html, /本实例只读/);
+});
+
+test("待审批页：显式 canWrite 但没有 csrf 也不渲染按钮（否则点了必 403）", () => {
+  const html = renderPage(withApproval(), "approvals", { canWrite: true });
+  assert.equal(html.includes("<form"), false);
+});
+
+test("待审批页脚：批准走同一套五道闸，拒绝不动任何技能文件", () => {
+  const html = renderPage(withApproval(), "approvals", { canWrite: true, csrf: "t" });
+  assert.match(html, /点「批准」= 在 TUI 敲/);
+  assert.match(html, /走同一套五道闸/);
+  assert.match(html, /「拒绝」只改队列状态，不动任何技能文件/);
+});
+
+test("待处理页脚：保留只读口径，并指向待审批页", () => {
+  const html = renderPage(emptyState(), "pending");
+  assert.match(html, /只读面板/);
+  assert.match(html, /去<a href="\/\?view=approvals">待审批页<\/a>直接批/);
+});
+
+test("动作结果横幅：msg 与 err 都渲染且转义", () => {
+  const ok = renderPage(emptyState(), "approvals", { notice: { kind: "msg", text: "已采纳 run-a" } });
+  assert.match(ok, /<p class="notice">已采纳 run-a<\/p>/);
+  const bad = renderPage(emptyState(), "approvals", { notice: { kind: "err", text: "<script>x</script>" } });
+  assert.match(bad, /<p class="notice err">&lt;script&gt;x&lt;\/script&gt;<\/p>/);
+  assert.equal(/<script/i.test(bad), false);
+});
+
+test("待审批页不做 5 秒自刷新：刷新会打断正在点的按钮", () => {
+  assert.equal(renderPage(emptyState(), "approvals").includes('http-equiv="refresh"'), false);
+});
+
+test("控制条：采集与复盘是两个独立开关，各自 post 到 /toggle?field=", () => {
+  const html = renderPage(emptyState(), "pending", {
+    controls: { telemetry: true, enabled: false, lastActivityAt: null },
+    csrf: "tok",
+    canWrite: true,
+  });
+  assert.match(html, /采集遥测：开/);
+  assert.match(html, /自动复盘：关/);
+  // 两个按钮各自打自己的字段：一个按钮同时翻两个，就回到了「捆在一起」的老问题
+  assert.equal(html.includes('action="/toggle?field=telemetry"'), true);
+  assert.equal(html.includes('action="/toggle?field=enabled"'), true);
+  assert.match(html, /只写本地日志，不花 token/);
+  assert.match(html, /会派生子进程，花 token/);
+  assert.match(html, /关闭采集遥测/, "按钮文案是动作（当前开 → 关闭），不是状态的复读");
+  assert.match(html, /开启自动复盘/);
+  assert.equal(html.includes("复盘在跑但采集关着"), false, "两个状态正常时不带警告");
+  // 只读（没 csrf）时两个开关只显示状态，不渲染表单
+  const readonly = renderPage(emptyState(), "pending", { controls: { telemetry: false, enabled: false, lastActivityAt: null } });
+  assert.match(readonly, /采集遥测：关/);
+  assert.equal(readonly.includes("/toggle?field="), false);
+});
+
+test("控制条：只开复盘不采集时给一行警告，两个都开后警告消失", () => {
+  const warn = renderPage(emptyState(), "pending", {
+    controls: { telemetry: false, enabled: true, lastActivityAt: null },
+    csrf: "tok",
+    canWrite: true,
+  });
+  assert.match(warn, /<p class="warn">⚠ 复盘在跑但采集关着：归因只能靠原始会话，加载率不可得<\/p>/);
+  const ok = renderPage(emptyState(), "pending", {
+    controls: { telemetry: true, enabled: true, lastActivityAt: null },
+    csrf: "tok",
+    canWrite: true,
+  });
+  assert.equal(ok.includes("复盘在跑但采集关着"), false);
+});

package/extensions/skill-evolve/test/web-run-detail.test.ts

@@ -0,0 +1,256 @@
+/**
+ * run 详情页的数据读取：六块证据各自退化、runId 越界一律 404、/diff 只回 text/plain。
+ * 全部喂临时目录 + 假 res 对象，不起子进程、不占端口。
+ */
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import type { ServerResponse } from "node:http";
+import test from "node:test";
+import { handleDiff, readRunDetail } from "../lib/web/run-detail.ts";
+
+const NOW = Date.UTC(2026, 10, 8, 12);
+const RUN_ID = "354df7db-1794133942";
+
+const DIFF_TEXT = [
+  "--- a/.pi/skills/demo/SKILL.md",
+  "+++ b/.pi/skills/demo/SKILL.md",
+  "@@ -1,2 +1,2 @@",
+  " ---",
+  "-description: 旧",
+  "+description: 新",
+].join("\n") + "\n";
+
+function workspace(): { evolutionDir: string; runDir: string; cwd: string } {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "skill-evolve-rundetail-"));
+  const evolutionDir = path.join(cwd, ".pi", "evolution");
+  const runDir = path.join(evolutionDir, "runs", RUN_ID);
+  fs.mkdirSync(runDir, { recursive: true });
+  return { evolutionDir, runDir, cwd };
+}
+
+function writeJson(file: string, value: unknown): void {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(value), "utf8");
+}
+
+function writeText(file: string, text: string): void {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, text, "utf8");
+}
+
+/** 造一个「证据齐全」的 run：run.json + diff + candidate + 评审 + 决策 + 五闸 + 发现 + child.log */
+function fullRun(): { evolutionDir: string; runDir: string } {
+  const { evolutionDir, runDir } = workspace();
+  writeJson(path.join(runDir, "run.json"), {
+    runId: RUN_ID,
+    status: "rejected",
+    trigger: "auto",
+    dispatchedAt: NOW,
+    pid: 65757,
+    sessionId: "s",
+    proposal: { type: "improve", skill: "demo", status: "ok", added: 1, removed: 1, file: "02-proposal.diff" },
+  });
+  writeText(path.join(runDir, "02-proposal.diff"), DIFF_TEXT);
+  writeText(path.join(runDir, "child.log"), "启动复盘子进程\nmcp timeout\n");
+  writeText(path.join(runDir, "candidate", "demo", "SKILL.md"), "---\nname: demo\n---\n# 改后\n");
+  writeJson(path.join(runDir, "03-review.json"), {
+    status: "rejected",
+    verdict: "revise",
+    action: "forbidden",
+    reviewerModel: "deepseek/deepseek-flash",
+    reviewedAt: NOW + 5_000,
+    notes: "证据不足",
+    blocking: [
+      {
+        issue: "描述承诺大于正文能力",
+        evidence: { file: ".pi/skills/demo/SKILL.md", line: 3, quote: "含 <script> 的引用" },
+      },
+      { issue: "缺少证据", evidence: {} },
+    ],
+  });
+  writeJson(path.join(runDir, "04-decision.json"), { status: "rejected", approver: "auto", at: NOW + 6_000 });
+  writeJson(path.join(runDir, "06-verify.json"), {
+    runId: RUN_ID,
+    status: "applied",
+    at: NOW + 7_000,
+    ms: 12,
+    wrote: [],
+    gates: [
+      { gate: "gate0", name: "授权核对", ok: true, ms: 1 },
+      { gate: "gate3", name: "复验", ok: false, ms: 2, detail: "复验失败" },
+    ],
+  });
+  writeJson(path.join(runDir, "01-findings.json"), {
+    skills: [
+      { name: "demo", advertised: true, loaded: false, whyNotLoaded: "G", confidence: "high", evidence: [{ line: 578 }, { line: 622 }] },
+      { name: "other", advertised: true, loaded: true, confidence: "medium" },
+    ],
+    notes: "只差两处",
+  });
+  return { evolutionDir, runDir };
+}
+
+interface FakeResponse {
+  status: number;
+  headers: Record<string, string>;
+  body: string;
+}
+
+function fakeResponse(): { res: ServerResponse; out: FakeResponse } {
+  const out: FakeResponse = { status: 0, headers: {}, body: "" };
+  const res = {
+    writeHead(status: number, headers: Record<string, string>) {
+      out.status = status;
+      out.headers = headers;
+      return res;
+    },
+    end(text: string) {
+      out.body = text;
+      return res;
+    },
+  } as unknown as ServerResponse;
+  return { res, out };
+}
+
+test("readRunDetail：六块证据（概要 / diff / 候选全文 / 评审 / 五闸 / 发现）一次读全", () => {
+  const { evolutionDir } = fullRun();
+  const detail = readRunDetail(evolutionDir, RUN_ID)!;
+  assert.equal(detail.runId, RUN_ID);
+  assert.equal(detail.status, "rejected");
+  assert.equal(detail.trigger, "auto");
+  assert.equal(detail.skill, "demo");
+  assert.equal(detail.pid, 65757);
+  assert.equal(detail.startedAt, NOW);
+  assert.equal(detail.endedAt, NOW + 7_000, "结束时间取最后一个产出时刻");
+  assert.equal(detail.hasChildLog, true);
+  assert.equal(detail.diff, DIFF_TEXT);
+  assert.equal(detail.candidateSkill, "demo");
+  assert.match(detail.candidateText ?? "", /# 改后/);
+  assert.deepEqual(detail.review, {
+    status: "rejected",
+    verdict: "revise",
+    action: "forbidden",
+    reviewerModel: "deepseek/deepseek-flash",
+  });
+  assert.equal(detail.blocking.length, 2);
+  assert.equal(detail.blocking[0]!.line, 3, "证据行号要能直接跳过去");
+  assert.match(detail.blocking[1]!.issue, /缺少证据/);
+  assert.equal(detail.blocking[1]!.file, "", "缺 evidence 的文件位置不能编一个");
+  assert.deepEqual(
+    detail.gates.map((gate) => `${gate.gate}:${gate.ok}`),
+    ["gate0:true", "gate3:false"],
+  );
+  assert.equal(detail.gates[1]!.detail, "复验失败");
+  assert.equal(detail.verifyStatus, "applied");
+  assert.equal(detail.findingsTotal, 2);
+  assert.deepEqual(
+    detail.findings[0],
+    // F / G 是复盘 agent 自己判的码，DISPOSITIONS 里没有（那里只有 A-E + semantic），原样显示
+    { skill: "demo", reason: "G", confidence: "high", lines: [578, 622] },
+  );
+  assert.equal(detail.findings[1]!.reason, "已加载");
+  assert.equal(detail.notes, "只差两处");
+});
+
+test("readRunDetail：runId 不合法（../、绝对路径、子路径）一律 null，不读盘越界", () => {
+  const { evolutionDir } = fullRun();
+  for (const runId of ["../x", "../../etc", "/etc/passwd", "a/b", "", "."]) {
+    assert.equal(readRunDetail(evolutionDir, runId), null, `runId=${JSON.stringify(runId)} 必须被挡住`);
+  }
+});
+
+test("readRunDetail：目录不存在 → null（不抛异常）", () => {
+  const { evolutionDir } = fullRun();
+  assert.equal(readRunDetail(evolutionDir, "00000000-0"), null);
+});
+
+test("readRunDetail：只剩 run.json 时六块各自空着，不是抛错也不是编数字", () => {
+  const { evolutionDir, runDir } = workspace();
+  writeJson(path.join(runDir, "run.json"), { runId: RUN_ID, status: "dispatched", trigger: "manual", dispatchedAt: NOW });
+  const detail = readRunDetail(evolutionDir, RUN_ID)!;
+  assert.equal(detail.diff, null);
+  assert.equal(detail.review, null);
+  assert.deepEqual(detail.blocking, []);
+  assert.deepEqual(detail.gates, []);
+  assert.equal(detail.verifyStatus, null);
+  assert.equal(detail.findingsTotal, 0);
+  assert.equal(detail.hasChildLog, false);
+  assert.equal(detail.candidateText, null);
+  assert.equal(detail.endedAt, null);
+  assert.equal(detail.pid, null);
+});
+
+test("readRunDetail：提案技能名含 ../ 时不读 candidate（拼路径越界）", () => {
+  const { evolutionDir, runDir } = workspace();
+  writeJson(path.join(runDir, "run.json"), {
+    runId: RUN_ID,
+    status: "reviewed",
+    trigger: "auto",
+    dispatchedAt: NOW,
+    proposal: { type: "improve", skill: "../../secret" },
+  });
+  writeText(path.join(evolutionDir, "secret", "SKILL.md"), "SECRET\n");
+  const detail = readRunDetail(evolutionDir, RUN_ID)!;
+  assert.equal(detail.skill, "../../secret", "展示原值即可，但不去读那个文件");
+  assert.equal(detail.candidateText, null);
+});
+
+test("readRunDetail：发现超过 20 条只收 20 条，总数照实报", () => {
+  const { evolutionDir, runDir } = workspace();
+  writeJson(path.join(runDir, "run.json"), { runId: RUN_ID, status: "analyzed", trigger: "auto", dispatchedAt: NOW });
+  const skills = Array.from({ length: 25 }, (_unused, index) => ({
+    name: `skill-${index + 1}`,
+    advertised: true,
+    loaded: false,
+    whyNotLoaded: "G",
+    confidence: "low",
+    evidence: [{ line: index + 1 }],
+  }));
+  writeJson(path.join(runDir, "01-findings.json"), { skills, notes: [] });
+  const detail = readRunDetail(evolutionDir, RUN_ID)!;
+  assert.equal(detail.findings.length, 20);
+  assert.equal(detail.findingsTotal, 25);
+  assert.equal(detail.findings[19]!.skill, "skill-20");
+});
+
+test("readRunDetail：run.json 没写 proposal 时用 02-proposal.json 的技能名（真实 run 就是这种）", () => {
+  const { evolutionDir } = workspace();
+  const runDir = path.join(evolutionDir, "runs", "run-real");
+  fs.mkdirSync(path.join(runDir, "candidate", "demo"), { recursive: true });
+  fs.writeFileSync(path.join(runDir, "run.json"), JSON.stringify({ runId: "run-real", status: "rejected" }), "utf8");
+  fs.writeFileSync(
+    path.join(runDir, "02-proposal.json"),
+    JSON.stringify({ type: "improve", skill: "demo", rationale: "", evidence: [], diffFile: "02-proposal.diff" }),
+    "utf8",
+  );
+  fs.writeFileSync(path.join(runDir, "candidate", "demo", "SKILL.md"), "改后全文\n", "utf8");
+  const detail = readRunDetail(evolutionDir, "run-real");
+  assert.equal(detail?.skill, "demo");
+  assert.equal(detail?.candidateSkill, "demo");
+  assert.equal(detail?.candidateText, "改后全文\n");
+});
+
+test("handleDiff：命中时回 200 + text/plain + diff 原文", () => {
+  const { evolutionDir } = fullRun();
+  const { res, out } = fakeResponse();
+  handleDiff(evolutionDir, res, new URL(`http://x/diff?runId=${RUN_ID}`));
+  assert.equal(out.status, 200);
+  assert.equal(out.headers["content-type"], "text/plain; charset=utf-8");
+  assert.equal(out.body, DIFF_TEXT);
+});
+
+test("handleDiff：没有 02-proposal.diff 与 runId 越界都是 404，文案说清缺什么", () => {
+  const { evolutionDir, runDir } = workspace();
+  writeJson(path.join(runDir, "run.json"), { runId: RUN_ID, status: "dispatched" });
+  const noDiff = fakeResponse();
+  handleDiff(evolutionDir, noDiff.res, new URL(`http://x/diff?runId=${RUN_ID}`));
+  assert.equal(noDiff.out.status, 404);
+  assert.match(noDiff.out.body, /404：这个 run 没写 02-proposal\.diff/);
+
+  const bad = fakeResponse();
+  handleDiff(evolutionDir, bad.res, new URL("http://x/diff?runId=../x"));
+  assert.equal(bad.out.status, 404);
+  assert.match(bad.out.body, /404：没有这个 run 的 diff/);
+});

package/extensions/skill-evolve/test/web-server-views.test.ts

@@ -0,0 +1,113 @@
+/**
+ * 三个新地址的 HTTP 接线：`?view=skills`、`?view=run&runId=`、`/diff?runId=`。
+ * 用 port 0 由内核分配随机端口（与 web-server.test.ts 同一手法），不起任何子进程、不抢固定端口。
+ * 渲染与读盘的细节在各自单测里，这一层只验证「路由接对了、状态码与 content-type 对了」。
+ */
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import test from "node:test";
+import { startWebPanel, type WebPanel } from "../lib/web/server.ts";
+
+const DIFF = [
+  "--- a/.pi/skills/demo/SKILL.md",
+  "+++ b/.pi/skills/demo/SKILL.md",
+  "@@ -1,1 +1,1 @@",
+  "-description: 旧",
+  "+description: 新",
+].join("\n");
+
+/** 工作区里放一个技能与一个带 diff 的 run，够三个地址都点得动 */
+function workspace(): string {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "skill-evolve-views-"));
+  const evolutionDir = path.join(cwd, ".pi", "evolution");
+  const skillDir = path.join(cwd, ".pi", "skills", "demo");
+  fs.mkdirSync(skillDir, { recursive: true });
+  fs.writeFileSync(path.join(skillDir, "SKILL.md"), "---\nname: demo\n---\n# demo\n", "utf8");
+  const runDir = path.join(evolutionDir, "runs", "run-diff");
+  fs.mkdirSync(runDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(runDir, "run.json"),
+    JSON.stringify({
+      runId: "run-diff",
+      status: "reviewed",
+      trigger: "auto",
+      pid: 1234,
+      dispatchedAt: Date.UTC(2026, 10, 8, 10),
+      skills: ["demo"],
+      proposal: { type: "improve", skill: "demo", status: "ok", added: 1, removed: 1, file: "02-proposal.diff" },
+    }),
+    "utf8",
+  );
+  fs.writeFileSync(path.join(runDir, "02-proposal.diff"), DIFF, "utf8");
+  return evolutionDir;
+}
+
+async function open(evolutionDir: string): Promise<WebPanel> {
+  const result = await startWebPanel({ evolutionDir, port: 0 });
+  assert.equal(result.ok, true, `面板应该起来：${result.ok ? "" : result.message}`);
+  if (!result.ok) throw new Error("unreachable");
+  return result.panel;
+}
+
+test("GET /?view=skills：技能管理页显式可访问，表格里有 .pi/skills 下的技能", async () => {
+  const panel = await open(workspace());
+  try {
+    const response = await fetch(`${panel.url}/?view=skills`);
+    assert.equal(response.status, 200);
+    assert.match(response.headers.get("content-type") ?? "", /text\/html/);
+    const html = await response.text();
+    assert.match(html, /<title>技能进化 · 技能管理<\/title>/);
+    assert.match(html, /<a href="\/\?view=skill&amp;name=demo&amp;days=30">demo<\/a>/);
+  } finally {
+    await panel.close();
+  }
+});
+
+test("GET /?view=skill&name=：带名字进详情，不带名字回技能管理（不让 ?view=skill 空页）", async () => {
+  const panel = await open(workspace());
+  try {
+    const detail = await (await fetch(`${panel.url}/?view=skill&name=demo`)).text();
+    assert.match(detail, /<title>技能进化 · 技能 demo<\/title>/);
+    assert.match(detail, /<a href="\/\?view=run&amp;runId=run-diff">run-diff<\/a>/);
+    const noName = await (await fetch(`${panel.url}/?view=skill`)).text();
+    assert.match(noName, /<title>技能进化 · 技能管理<\/title>/);
+  } finally {
+    await panel.close();
+  }
+});
+
+test("GET /?view=run&runId=：真 run 出 diff 视图，不存在的 run 是 404 text/plain", async () => {
+  const panel = await open(workspace());
+  try {
+    const response = await fetch(`${panel.url}/?view=run&runId=run-diff`);
+    assert.equal(response.status, 200);
+    const html = await response.text();
+    assert.match(html, /<title>技能进化 · run run-diff<\/title>/);
+    assert.match(html, /<pre class="diff">/);
+    assert.match(html, /<span class="dl add">/);
+    for (const bad of ["run-nope", "../../etc/passwd", "a/b"]) {
+      const missing = await fetch(`${panel.url}/?view=run&runId=${encodeURIComponent(bad)}`);
+      assert.equal(missing.status, 404, `runId=${bad} 必须 404`);
+      assert.match(missing.headers.get("content-type") ?? "", /text\/plain/);
+      assert.equal((await missing.text()).includes("description"), false, "404 页不能带出 diff 内容");
+    }
+  } finally {
+    await panel.close();
+  }
+});
+
+test("GET /diff：完整 diff 是 text/plain 原文；越界与没有 diff 的 run 都 404", async () => {
+  const panel = await open(workspace());
+  try {
+    const response = await fetch(`${panel.url}/diff?runId=run-diff`);
+    assert.equal(response.status, 200);
+    assert.match(response.headers.get("content-type") ?? "", /text\/plain; charset=utf-8/);
+    assert.equal(await response.text(), DIFF);
+    assert.equal((await fetch(`${panel.url}/diff?runId=../queue.json`)).status, 404);
+    assert.equal((await fetch(`${panel.url}/diff?runId=run-nope`)).status, 404);
+  } finally {
+    await panel.close();
+  }
+});