pi-skill-evolve 0.0.0-stage → 0.1.2

package/extensions/skill-evolve/test/web-actions.test.ts

@@ -0,0 +1,262 @@
+/**
+ * `POST /action` 的三个动作：run / rerun / cleanup，以及开关入口 `POST /toggle?field=` ——
+ * 参数校验、回调调用次数、以及「成功与失败都写一条审计」。真监听 127.0.0.1（port=0），不起子进程。
+ */
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import test from "node:test";
+import { readAudit } from "../lib/web/audit-log.ts";
+import { startWebPanel, type WebPanel, type WebPanelOptions } from "../lib/web/server.ts";
+import { moveRunToTrash } from "../lib/web/trash.ts";
+
+const FORM = "application/x-www-form-urlencoded";
+
+function workspace(options: { enabled?: boolean; telemetry?: boolean; runs?: { runId: string; status: string }[] } = {}): string {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "skill-evolve-webaction-"));
+  const evolutionDir = path.join(cwd, ".pi", "evolution");
+  fs.mkdirSync(path.join(evolutionDir, "runs"), { recursive: true });
+  fs.writeFileSync(
+    path.join(evolutionDir, "config.json"),
+    JSON.stringify({ enabled: options.enabled === true, telemetry: options.telemetry === true }),
+    "utf8",
+  );
+  for (const run of options.runs ?? []) {
+    const runDir = path.join(evolutionDir, "runs", run.runId);
+    fs.mkdirSync(runDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(runDir, "run.json"),
+      JSON.stringify({ runId: run.runId, status: run.status, dispatchedAt: Date.now() - 60_000 }),
+      "utf8",
+    );
+  }
+  return evolutionDir;
+}
+
+async function open(evolutionDir: string, extra: Partial<WebPanelOptions> = {}): Promise<WebPanel> {
+  const result = await startWebPanel({ evolutionDir, port: 0, ...extra });
+  assert.equal(result.ok, true, `面板应该起来：${result.ok ? "" : result.message}`);
+  if (!result.ok) throw new Error("unreachable");
+  return result.panel;
+}
+
+async function post(panel: WebPanel, pathname: string, form: Record<string, string>): Promise<Response> {
+  return fetch(`${panel.url}${pathname}`, {
+    method: "POST",
+    headers: { "content-type": FORM },
+    body: new URLSearchParams(form).toString(),
+    redirect: "manual",
+  });
+}
+
+/** 记一次调用的假回调：断言「恰一次」比断言返回值更能发现重复执行 */
+function spy<T>(result: T): { calls: unknown[]; fn: (...args: unknown[]) => Promise<T> } {
+  const calls: unknown[] = [];
+  return {
+    calls,
+    fn: async (...args: unknown[]) => {
+      calls.push(args[0]);
+      return result;
+    },
+  };
+}
+
+/** 两个参数的开关回调：采集与复盘是同一类型的钩子（field, next），要同时看两个参数 */
+function spyToggle(result: string): { calls: [string, boolean][]; fn: (field: string, next: boolean) => Promise<string> } {
+  const calls: [string, boolean][] = [];
+  return { calls, fn: async (field: string, next: boolean) => (calls.push([field, next]), result) };
+}
+
+test("POST /toggle?field=enabled：只调 onToggle(\"enabled\", 取反)，审计记 field", async () => {
+  const evolutionDir = workspace({ enabled: true });
+  const toggle = spyToggle("自动复盘已关闭");
+  const panel = await open(evolutionDir, { onToggle: toggle.fn });
+  try {
+    const response = await post(panel, "/toggle?field=enabled", { csrf: panel.csrf, view: "done" });
+    assert.equal(response.status, 303);
+    assert.deepEqual(toggle.calls, [["enabled", false]], "当前是开的 → 传 false（取反，不是传页面上的旧文字）");
+    const location = new URL(response.headers.get("location") ?? "", panel.url);
+    assert.equal(location.searchParams.get("view"), "done", "回跳到点按钮时那一页");
+    assert.equal(location.searchParams.get("msg"), "自动复盘已关闭");
+    const audit = readAudit(evolutionDir);
+    assert.equal(audit.length, 1);
+    assert.equal(audit[0]?.action, "toggle");
+    assert.equal(audit[0]?.field, "enabled");
+    assert.equal(audit[0]?.result, "ok");
+    assert.equal(audit[0]?.via, "web");
+  } finally {
+    await panel.close();
+  }
+});
+
+test("POST /toggle?field=telemetry：只动采集，不动复盘", async () => {
+  const evolutionDir = workspace({ enabled: true, telemetry: false });
+  const toggle = spyToggle("采集遥测已开启");
+  const panel = await open(evolutionDir, { onToggle: toggle.fn });
+  try {
+    assert.equal((await post(panel, "/toggle?field=telemetry", { csrf: panel.csrf })).status, 303);
+    assert.deepEqual(toggle.calls, [["telemetry", true]], "当前采集是关的 → 传 true，且 field 只能是 telemetry");
+    assert.equal(readAudit(evolutionDir).at(-1)?.field, "telemetry");
+  } finally {
+    await panel.close();
+  }
+});
+
+test("POST /toggle 的 field 越界 / 缺失：400，不调回调，写一条带原值的 error 审计", async () => {
+  const evolutionDir = workspace({ enabled: true, telemetry: true });
+  const toggle = spyToggle("不该被调用");
+  const panel = await open(evolutionDir, { onToggle: toggle.fn });
+  try {
+    const wrong = await post(panel, "/toggle?field=propose", { csrf: panel.csrf });
+    assert.equal(wrong.status, 400);
+    assert.match(await wrong.text(), /field 只认 telemetry \/ enabled/);
+    const missing = await post(panel, "/toggle", { csrf: panel.csrf });
+    assert.equal(missing.status, 400, "缺 field 不能猜一个默认值");
+    assert.deepEqual(toggle.calls, [], "越界不放行到回调");
+    const audit = readAudit(evolutionDir);
+    assert.deepEqual(
+      audit.map((entry) => [entry.action, entry.field, entry.result.startsWith("error: ")]),
+      [["toggle", "propose", true], ["toggle", undefined, true]],
+    );
+  } finally {
+    await panel.close();
+  }
+});
+
+test("POST /action name=run：onRunNow 恰一次；派发了记 ok、没派发记 partial", async () => {
+  const evolutionDir = workspace();
+  const runNow = spy("已派生复盘：run-new（pid 4242）");
+  const panel = await open(evolutionDir, { onRunNow: runNow.fn as () => Promise<string> });
+  try {
+    assert.equal((await post(panel, "/action", { csrf: panel.csrf, name: "run" })).status, 303);
+    assert.equal(runNow.calls.length, 1, "点一次只能派发一次");
+    assert.equal(readAudit(evolutionDir).at(-1)?.result, "ok");
+  } finally {
+    await panel.close();
+  }
+  const skipped = spy("技能进化总开关是关的：不改配置就只读历史");
+  const second = await open(evolutionDir, { onRunNow: skipped.fn as () => Promise<string> });
+  try {
+    assert.equal((await post(second, "/action", { csrf: second.csrf, name: "run" })).status, 303);
+    const audit = readAudit(evolutionDir).at(-1);
+    assert.equal(audit?.action, "run");
+    assert.equal(audit?.result, "partial", "没派发就是 partial：否则「点了十次都没跑」查不出来");
+  } finally {
+    await second.close();
+  }
+});
+
+test("POST /action name=rerun：不带旧 runId 派发（不复用），审计记下点的是哪一条", async () => {
+  const evolutionDir = workspace({ runs: [{ runId: "run-a", status: "reviewed" }] });
+  const runNow = spy("已派生复盘：run-b（pid 7）");
+  const panel = await open(evolutionDir, { onRunNow: runNow.fn as () => Promise<string> });
+  try {
+    assert.equal((await post(panel, "/action", { csrf: panel.csrf, name: "rerun", runId: "run-a" })).status, 303);
+    assert.equal(runNow.calls.length, 1);
+    const audit = readAudit(evolutionDir).at(-1);
+    assert.equal(audit?.action, "rerun");
+    assert.equal(audit?.runId, "run-a");
+    assert.equal(audit?.result, "ok");
+  } finally {
+    await panel.close();
+  }
+});
+
+test("POST /action name=rerun：runId 不存在 → 400、不派发、写一条 error 审计", async () => {
+  const evolutionDir = workspace();
+  const runNow = spy("已派生复盘：run-b");
+  const panel = await open(evolutionDir, { onRunNow: runNow.fn as () => Promise<string> });
+  try {
+    const response = await post(panel, "/action", { csrf: panel.csrf, name: "rerun", runId: "run-missing" });
+    assert.equal(response.status, 400);
+    assert.match(await response.text(), /找不到这个 run/);
+    assert.deepEqual(runNow.calls, [], "目标不存在时一次都不能派发");
+    const audit = readAudit(evolutionDir).at(-1);
+    assert.equal(audit?.action, "rerun");
+    assert.match(audit?.result ?? "", /^error: 找不到这个 run/);
+  } finally {
+    await panel.close();
+  }
+});
+
+test("POST /action name=cleanup：stale 的 run 被移进 runs/.trash/，审计 ok", async () => {
+  const evolutionDir = workspace({ runs: [{ runId: "run-dead", status: "stale" }] });
+  const cleanup = spy("");
+  const panel = await open(evolutionDir, {
+    onCleanup: (runId: string) => {
+      cleanup.calls.push(runId);
+      return Promise.resolve(moveRunToTrash(evolutionDir, runId));
+    },
+  });
+  try {
+    const response = await post(panel, "/action", { csrf: panel.csrf, name: "cleanup", runId: "run-dead" });
+    assert.equal(response.status, 303);
+    assert.deepEqual(cleanup.calls, ["run-dead"]);
+    assert.equal(fs.existsSync(path.join(evolutionDir, "runs", "run-dead")), false, "原目录不该还在");
+    const trash = fs.readdirSync(path.join(evolutionDir, "runs", ".trash"));
+    assert.equal(trash.length, 1);
+    assert.match(trash[0]!, /^run-dead-\d{8}-\d{6}$/);
+    assert.equal(fs.existsSync(path.join(evolutionDir, "runs", ".trash", trash[0]!, "run.json")), true, "是移动不是删除");
+    const audit = readAudit(evolutionDir).at(-1);
+    assert.equal(audit?.action, "cleanup");
+    assert.equal(audit?.runId, "run-dead");
+    assert.equal(audit?.result, "ok");
+  } finally {
+    await panel.close();
+  }
+});
+
+test("POST /action name=cleanup：非 stale 一律拒绝（不移动、写 error 审计）", async () => {
+  const evolutionDir = workspace({ runs: [{ runId: "run-live", status: "applied" }] });
+  const cleanup = spy("");
+  const panel = await open(evolutionDir, { onCleanup: cleanup.fn as (runId: string) => Promise<string> });
+  try {
+    const response = await post(panel, "/action", { csrf: panel.csrf, name: "cleanup", runId: "run-live" });
+    assert.equal(response.status, 400);
+    assert.match(await response.text(), /只有卡死（stale）的 run 能清理，当前状态：applied/);
+    assert.deepEqual(cleanup.calls, [], "非 stale 不能调清理");
+    assert.equal(fs.existsSync(path.join(evolutionDir, "runs", "run-live")), true, "目录还在");
+    const audit = readAudit(evolutionDir).at(-1);
+    assert.equal(audit?.action, "cleanup");
+    assert.match(audit?.result ?? "", /^error: 只有卡死/);
+  } finally {
+    await panel.close();
+  }
+});
+
+test("回调抛错：303 带 err 而不是 500，同时写一条 error 审计", async () => {
+  const evolutionDir = workspace({ enabled: false });
+  const panel = await open(evolutionDir, {
+    onToggle: () => Promise.reject(new Error("config.json 不可写：EACCES")),
+  });
+  try {
+    const response = await post(panel, "/toggle?field=telemetry", { csrf: panel.csrf });
+    assert.equal(response.status, 303);
+    const location = new URL(response.headers.get("location") ?? "", panel.url);
+    assert.equal(location.searchParams.get("err"), "Error: config.json 不可写：EACCES");
+    assert.equal((await fetch(panel.url)).status, 200, "面板本身照常工作");
+    const audit = readAudit(evolutionDir).at(-1);
+    assert.equal(audit?.action, "toggle");
+    assert.equal(audit?.field, "telemetry", "失败审计也要能看出点的是哪个开关");
+    assert.equal(audit?.result, "error: Error: config.json 不可写：EACCES");
+  } finally {
+    await panel.close();
+  }
+});
+
+test("未注入写回调：/action 与 /toggle 一律 403「本实例只读」，且不写审计（什么都没发生）", async () => {
+  const evolutionDir = workspace();
+  const panel = await open(evolutionDir);
+  try {
+    const response = await post(panel, "/action", { csrf: panel.csrf, name: "run" });
+    assert.equal(response.status, 403);
+    assert.match(await response.text(), /本实例只读/);
+    const toggle = await post(panel, "/toggle?field=enabled", { csrf: panel.csrf });
+    assert.equal(toggle.status, 403);
+    assert.match(await toggle.text(), /本实例只读/);
+    assert.deepEqual(readAudit(evolutionDir), []);
+  } finally {
+    await panel.close();
+  }
+});

package/extensions/skill-evolve/test/web-applied.test.ts

@@ -0,0 +1,100 @@
+/**
+ * 「已采纳」单独成 tab：列表只列 applied，已处理页一条 applied 都不许有。
+ * 行里的五闸要分三种说法：全 ok / N 项失败 / 无记录（判不了 ≠ 没过）。
+ */
+import assert from "node:assert/strict";
+import test from "node:test";
+import type { AppliedItem } from "../lib/web/applied.ts";
+import type { DoneItem, WebState } from "../lib/web/data.ts";
+import { renderPage } from "../lib/web/render.ts";
+import { appliedRows } from "../lib/web/render-rows.ts";
+
+const NOW = new Date(2026, 10, 8, 12).getTime();
+
+function item(parts: Partial<AppliedItem> = {}): AppliedItem {
+  return {
+    runId: "run-a-1794133942",
+    level: "approval",
+    skill: "demo",
+    type: "improve",
+    added: 3,
+    removed: 1,
+    appliedAt: NOW,
+    gates: [
+      { gate: "gate0", name: "授权核对", ok: true },
+      { gate: "gate1", name: "备份", ok: true },
+    ],
+    gatesOk: true,
+    ...parts,
+  };
+}
+
+function done(runId: string, status: string, skill: string): DoneItem {
+  return { runId, status, source: "run", level: "-", skill, at: NOW, detail: "" };
+}
+
+function state(parts: Partial<WebState> = {}): WebState {
+  return {
+    pending: [],
+    approvals: [],
+    applied: [],
+    done: [],
+    reports: [],
+    summary: { reviewing: 0, stale: 0, pendingApprovals: 0, appliedTotal: 1, rollbackRate: 0 },
+    ...parts,
+  };
+}
+
+test("已采纳行：技能 · 提案类型 · +N/-M · 采纳时间 · 五闸全 ok", () => {
+  const html = appliedRows([item()]);
+  assert.match(html, /\[applied\] <a class="run" href="\/\?view=run&amp;runId=run-a-1794133942">run-a-1794133942<\/a>/);
+  assert.match(html, / · demo · improve \+3\/-1 · 2026-11-08 12:00 · 五闸：全 ok/);
+  assert.match(html, /gate0 授权核对 ✓/);
+  assert.match(html, /完整 diff：点上方 runId 进详情页/);
+  assert.match(html, /看 diff/);
+});
+
+test("已采纳行：有一闸没过要说几项失败，并提示这是异常", () => {
+  const html = appliedRows([
+    item({ gates: [{ gate: "gate3", name: "复验", ok: false }], gatesOk: false }),
+  ]);
+  assert.match(html, /五闸：1 项失败/);
+  assert.match(html, /gate3 复验 ✗/);
+  assert.match(html, /注意：有闸没过却仍被采纳，先看 06-verify\.json/);
+});
+
+test("已采纳行：没有 06-verify.json 时写「无记录」，不写成「失败」", () => {
+  const html = appliedRows([item({ gates: [], gatesOk: null })]);
+  assert.match(html, /五闸：无记录/);
+  assert.match(html, /五闸：没有 06-verify\.json（无法判定）/);
+  assert.equal(html.includes("项失败"), false);
+});
+
+test("已采纳页只列 applied；已处理页一条 applied 都没有（两页不再混）", () => {
+  const shared = state({
+    applied: [item({ runId: "run-applied" })],
+    done: [done("run-rolled", "rolled-back", "demo"), done("run-rejected", "rejected", "other")],
+  });
+  const appliedPage = renderPage(shared, "applied", { now: NOW });
+  assert.match(appliedPage, /<title>技能进化 · 已采纳<\/title>/);
+  assert.match(appliedPage, /<a href="\/\?view=applied" class="active">已采纳<\/a>/);
+  assert.match(appliedPage, /run-applied/);
+  assert.equal(appliedPage.includes("run-rolled"), false, "回滚的不算已采纳");
+
+  const donePage = renderPage(shared, "done", { now: NOW });
+  assert.match(donePage, /<title>技能进化 · 已处理<\/title>/);
+  assert.match(donePage, /run-rolled/);
+  assert.match(donePage, /run-rejected/);
+  assert.equal(donePage.includes("run-applied"), false, "applied 已经移出已处理页");
+});
+
+test("已采纳页空态：说清采纳过的连 diff 一起留在这里", () => {
+  const html = renderPage(state(), "applied", { now: NOW });
+  assert.match(html, /<p class="empty">还没有已采纳的提案：采纳过的会连 diff 一起留在这里。<\/p>/);
+});
+
+test("已采纳页有筛选与分页，但没有自动刷新（历史页刷新会把人弹回顶部）", () => {
+  const html = renderPage(state({ applied: [item()] }), "applied", { now: NOW });
+  assert.match(html, /<form class="filter"/);
+  assert.equal(html.includes('http-equiv="refresh"'), false);
+});

package/extensions/skill-evolve/test/web-audit.test.ts

@@ -0,0 +1,87 @@
+/**
+ * Web 操作审计（`.pi/evolution/actions.log`）：只追加、坏行跳过、只读尾部 limit 条。
+ * 全部用临时目录，不起任何子进程。
+ */
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import test from "node:test";
+import { AUDIT_FILE, appendAudit, auditFile, readAudit, type AuditEntry } from "../lib/web/audit-log.ts";
+
+function evolutionDir(): string {
+  return path.join(fs.mkdtempSync(path.join(os.tmpdir(), "skill-evolve-audit-")), ".pi", "evolution");
+}
+
+function entry(overrides: Partial<AuditEntry> = {}): AuditEntry {
+  return { at: 1_760_000_000_000, action: "run", result: "ok", via: "web", ...overrides };
+}
+
+test("appendAudit：目录不存在也建，一行一条 JSONL，字段齐全", () => {
+  const dir = evolutionDir();
+  appendAudit(dir, entry());
+  const text = fs.readFileSync(auditFile(dir), "utf8");
+  assert.equal(text.split("\n").filter((line) => line.length > 0).length, 1);
+  assert.deepEqual(JSON.parse(text.trim()), { at: 1_760_000_000_000, action: "run", result: "ok", via: "web" });
+  assert.equal(path.basename(auditFile(dir)), AUDIT_FILE);
+});
+
+test("appendAudit：追加不覆盖，readAudit 按文件顺序（老的在前）返回", () => {
+  const dir = evolutionDir();
+  appendAudit(dir, entry({ at: 1, action: "toggle" }));
+  appendAudit(dir, entry({ at: 2, action: "cleanup", runId: "run-a" }));
+  const entries = readAudit(dir);
+  assert.deepEqual(
+    entries.map((item) => item.action),
+    ["toggle", "cleanup"],
+  );
+  assert.equal(entries[1]?.runId, "run-a");
+  assert.equal("runId" in entries[0]!, false, "没有 runId 的条目不写这个字段");
+});
+
+test("readAudit：文件不存在返回空数组（没发生过动作不是错误）", () => {
+  assert.deepEqual(readAudit(evolutionDir()), []);
+});
+
+test("readAudit：坏行跳过（半行 / 非 JSON / 未知动作 / 缺字段 / via 不是 web），好行照常返回", () => {
+  const dir = evolutionDir();
+  fs.mkdirSync(dir, { recursive: true });
+  const good = JSON.stringify(entry({ action: "reject" }));
+  const lines = [
+    good,
+    '{"at": 1, "action": "tog', // 写入中途被杀留下的半行
+    "not json at all",
+    JSON.stringify({ at: 3, action: "not-an-action", result: "ok", via: "web" }),
+    JSON.stringify({ action: "run", result: "ok", via: "web" }), // 缺 at
+    JSON.stringify({ at: 4, action: "run", result: "", via: "web" }), // 空 result
+    JSON.stringify({ at: 5, action: "run", result: "ok", via: "tui" }),
+    "",
+  ];
+  fs.writeFileSync(auditFile(dir), `${lines.join("\n")}\n`, "utf8");
+  const entries = readAudit(dir);
+  assert.equal(entries.length, 1);
+  assert.equal(entries[0]?.action, "reject");
+});
+
+test("readAudit：limit 只取尾部 N 条（默认 20）", () => {
+  const dir = evolutionDir();
+  for (let index = 1; index <= 25; index += 1) appendAudit(dir, entry({ at: index }));
+  assert.deepEqual(
+    readAudit(dir, 3).map((item) => item.at),
+    [23, 24, 25],
+  );
+  const all = readAudit(dir);
+  assert.equal(all.length, 20, "默认 limit=20");
+  assert.equal(all[0]?.at, 6);
+  assert.equal(all[19]?.at, 25);
+  assert.deepEqual(readAudit(dir, 0), [], "limit=0 = 一条都不要");
+});
+
+test("readAudit：error 结果原样保留（带原因），供页面区分 ok / partial / 失败", () => {
+  const dir = evolutionDir();
+  appendAudit(dir, entry({ result: "partial" }));
+  appendAudit(dir, entry({ result: "error: 只有卡死（stale）的 run 能清理，当前状态：applied", runId: "run-b" }));
+  const [, failed] = readAudit(dir);
+  assert.equal(failed?.result, "error: 只有卡死（stale）的 run 能清理，当前状态：applied");
+  assert.equal(failed?.runId, "run-b");
+});