progmune-runtime 3.3.8 → 3.4.0

package/dist/agent-loop.test.js

@@ -0,0 +1,256 @@
+"use strict";
+/**
+ * Phase 12: Agent Loop Controller 测试
+ *
+ * 覆盖 M1 验收要点：
+ *   - 首次尝试即过全部验证门 → 成功出口，retries=0
+ *   - 执行失败 → 反馈注入 → 重试成功（验证 feedback 注入到下一次意图）
+ *   - 写盘后验证门失败（编译不过）→ 触发重试而非误报成功
+ *   - 全部重试耗尽 → 失败出口，attempts = iterations × retries，审计轨迹完整
+ *
+ * 不触碰真实文件系统 / LLM / git —— 全部依赖 mock（仓库测试惯例）。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const execute_1 = require("./execute");
+const goal_planner_1 = require("./goal-planner");
+const child_process_1 = require("child_process");
+const agent_perception_1 = require("./agent-perception");
+const agent_supervision_1 = require("./agent-supervision");
+const agent_loop_1 = require("./agent-loop");
+vitest_1.vi.mock("./execute", () => ({
+    execute: vitest_1.vi.fn(),
+    verifyCompiles: vitest_1.vi.fn(),
+    verifyFileMarker: vitest_1.vi.fn(),
+}));
+vitest_1.vi.mock("./goal-planner", () => ({
+    expandGoalActions: vitest_1.vi.fn(),
+}));
+vitest_1.vi.mock("child_process", () => ({
+    execSync: vitest_1.vi.fn(),
+}));
+vitest_1.vi.mock("./agent-perception", () => ({
+    collectGitContext: vitest_1.vi.fn(),
+    extractIRWithDelta: vitest_1.vi.fn(),
+}));
+vitest_1.vi.mock("./agent-supervision", () => ({
+    runProjectTests: vitest_1.vi.fn(),
+}));
+const mockExecute = vitest_1.vi.mocked(execute_1.execute);
+const mockVerifyCompiles = vitest_1.vi.mocked(execute_1.verifyCompiles);
+const mockVerifyFileMarker = vitest_1.vi.mocked(execute_1.verifyFileMarker);
+const mockExpandGoals = vitest_1.vi.mocked(goal_planner_1.expandGoalActions);
+const mockExecSync = vitest_1.vi.mocked(child_process_1.execSync);
+const mockCollectGitContext = vitest_1.vi.mocked(agent_perception_1.collectGitContext);
+const mockExtractIRWithDelta = vitest_1.vi.mocked(agent_perception_1.extractIRWithDelta);
+const mockRunProjectTests = vitest_1.vi.mocked(agent_supervision_1.runProjectTests);
+/** 构造一个成功的 ExecuteResult */
+function okResult(overrides = {}) {
+    return {
+        success: true,
+        code: "/**\n * @progmune-generated session=sess_test timestamp=2026-08-21T00:00:00.000Z\n */\nexport function f() { return 1; }",
+        sessionId: "sess_test",
+        hash: "fp1234567890abcd",
+        ruleHash: "rulehash123",
+        irFunctionCount: 3,
+        protocolRuleCount: 10,
+        violations: 0,
+        degraded: false,
+        repairApplied: false,
+        repairCount: 0,
+        repairBranchIds: [],
+        ...overrides,
+    };
+}
+/** 构造一个失败的 ExecuteResult */
+function failResult(error) {
+    return {
+        success: false,
+        code: "",
+        sessionId: "",
+        hash: "",
+        ruleHash: "",
+        irFunctionCount: 0,
+        protocolRuleCount: 0,
+        violations: 0,
+        degraded: false,
+        repairApplied: false,
+        repairCount: 0,
+        repairBranchIds: [],
+        error,
+    };
+}
+(0, vitest_1.beforeEach)(() => {
+    vitest_1.vi.clearAllMocks();
+    mockExpandGoals.mockReturnValue([]);
+    mockVerifyCompiles.mockReturnValue({ pass: true, errors: [] });
+    mockVerifyFileMarker.mockReturnValue({ marked: true });
+    mockExecSync.mockReturnValue("mock diff");
+    mockExtractIRWithDelta.mockReturnValue({
+        ir: [{ name: "verify_password" }, { name: "main" }],
+        delta: { added: [], removed: [], functionCount: 2 },
+    });
+    mockRunProjectTests.mockReturnValue({ ran: false, pass: true, failures: [], command: "(无测试脚本)" });
+    mockCollectGitContext.mockReturnValue({
+        available: true,
+        branch: "main",
+        recentCommits: ["abc123 feat: login"],
+        changedFiles: ["src/auth.ts"],
+        sourceFiles: ["src/auth.ts"],
+    });
+});
+(0, vitest_1.describe)("agent-loop", () => {
+    (0, vitest_1.it)("首次尝试通过全部验证门 → 成功出口，retries=0，审计轨迹完整", async () => {
+        mockExecute.mockResolvedValue(okResult());
+        const r = await (0, agent_loop_1.runAgentLoop)({
+            projectPath: "/tmp/fake-project",
+            intent: "实现验证函数",
+            filePath: "out.ts",
+        });
+        (0, vitest_1.expect)(r.success).toBe(true);
+        (0, vitest_1.expect)(r.retries).toBe(0);
+        (0, vitest_1.expect)(r.iterations).toBe(1);
+        (0, vitest_1.expect)(r.attempts).toHaveLength(1);
+        (0, vitest_1.expect)(r.fingerprint).toBe("fp1234567890abcd");
+        (0, vitest_1.expect)(r.filePath).toBe("out.ts");
+        const events = r.auditTrail.map((e) => e.event);
+        (0, vitest_1.expect)(events).toContain("loop:start");
+        (0, vitest_1.expect)(events).toContain("attempt:start");
+        (0, vitest_1.expect)(events).toContain("attempt:ok");
+        (0, vitest_1.expect)(events).toContain("loop:success");
+        (0, vitest_1.expect)(r.auditTrail.every((e) => !!e.timestamp)).toBe(true);
+    });
+    (0, vitest_1.it)("执行失败 → 反馈注入下一次意图 → 重试成功", async () => {
+        mockExecute
+            .mockResolvedValueOnce(failResult("Planning failed: LLM 超时"))
+            .mockResolvedValueOnce(okResult());
+        const r = await (0, agent_loop_1.runAgentLoop)({
+            projectPath: "/tmp/fake-project",
+            intent: "实现支付函数",
+            filePath: "pay.ts",
+        });
+        (0, vitest_1.expect)(r.success).toBe(true);
+        (0, vitest_1.expect)(r.retries).toBe(1);
+        (0, vitest_1.expect)(r.attempts).toHaveLength(2);
+        // 第二次尝试的意图必须包含注入的失败反馈
+        (0, vitest_1.expect)(r.attempts[1].intent).toContain("[上一次尝试失败");
+        (0, vitest_1.expect)(r.attempts[1].intent).toContain("Planning failed: LLM 超时");
+        (0, vitest_1.expect)(mockExecute).toHaveBeenCalledTimes(2);
+    });
+    (0, vitest_1.it)("写盘后验证门失败（编译不过）→ 触发重试而非误报成功", async () => {
+        mockExecute.mockResolvedValue(okResult());
+        mockVerifyCompiles
+            .mockReturnValueOnce({ pass: false, errors: ["out.ts:1 error TS1005"] })
+            .mockReturnValue({ pass: true, errors: [] });
+        const r = await (0, agent_loop_1.runAgentLoop)({
+            projectPath: "/tmp/fake-project",
+            intent: "实现工具函数",
+            filePath: "util.ts",
+        });
+        (0, vitest_1.expect)(r.success).toBe(true);
+        (0, vitest_1.expect)(r.attempts).toHaveLength(2);
+        (0, vitest_1.expect)(r.attempts[0].success).toBe(false); // 编译门失败 → 该次尝试不算成功
+        (0, vitest_1.expect)(r.attempts[0].compilePass).toBe(false);
+        (0, vitest_1.expect)(r.attempts[1].intent).toContain("编译验证未通过");
+    });
+    (0, vitest_1.it)("全部重试耗尽 → 失败出口，attempts = iterations × retries，反馈不静默", async () => {
+        mockExecute.mockResolvedValue(failResult("总是失败"));
+        const r = await (0, agent_loop_1.runAgentLoop)({
+            projectPath: "/tmp/fake-project",
+            intent: "实现不可能的函数",
+            filePath: "x.ts",
+            maxIterations: 2,
+            maxRetries: 3,
+        });
+        (0, vitest_1.expect)(r.success).toBe(false);
+        (0, vitest_1.expect)(r.attempts).toHaveLength(6);
+        (0, vitest_1.expect)(r.iterations).toBe(2);
+        (0, vitest_1.expect)(r.retries).toBe(6);
+        // 每轮重试都注入反馈，耗尽后最后一轮结束事件在
+        const events = r.auditTrail.map((e) => e.event);
+        (0, vitest_1.expect)(events).toContain("loop:exhausted");
+        (0, vitest_1.expect)(events.filter((e) => e === "retry")).toHaveLength(4); // 2 轮 × 每轮 2 次注入
+        (0, vitest_1.expect)(events.filter((e) => e === "iteration:end")).toHaveLength(2);
+    });
+    (0, vitest_1.it)("execute 抛异常 → 兜底为失败结果并继续重试", async () => {
+        mockExecute
+            .mockRejectedValueOnce(new Error("crash"))
+            .mockResolvedValue(okResult());
+        const r = await (0, agent_loop_1.runAgentLoop)({
+            projectPath: "/tmp/fake-project",
+            intent: "实现函数",
+            filePath: "f.ts",
+        });
+        (0, vitest_1.expect)(r.success).toBe(true);
+        (0, vitest_1.expect)(r.attempts[0].error).toContain("execute 抛出异常: crash");
+        (0, vitest_1.expect)(r.attempts[1].intent).toContain("execute 抛出异常");
+    });
+    (0, vitest_1.it)("未指定 filePath 时成功出口 diff 为空占位", async () => {
+        mockExecute.mockResolvedValue(okResult());
+        const r = await (0, agent_loop_1.runAgentLoop)({
+            projectPath: "/tmp/fake-project",
+            intent: "生成代码片段",
+        });
+        (0, vitest_1.expect)(r.success).toBe(true);
+        (0, vitest_1.expect)(r.diff).toBe("(未指定输出文件，无 diff)");
+        (0, vitest_1.expect)(mockExecSync).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("P3 测试门：项目测试失败 → 注入测试反馈重试，测试通过后成功", async () => {
+        mockExecute.mockResolvedValue(okResult());
+        mockRunProjectTests
+            .mockReturnValueOnce({
+            ran: true, pass: false, failures: ["FAIL login.test.ts", "AssertionError: token 无效"], command: "npm test",
+        })
+            .mockReturnValue({ ran: true, pass: true, failures: [], command: "npm test" });
+        const r = await (0, agent_loop_1.runAgentLoop)({
+            projectPath: "/tmp/fake-project",
+            intent: "实现登录流程",
+            filePath: "login.ts",
+            runTests: true,
+        });
+        (0, vitest_1.expect)(r.success).toBe(true);
+        (0, vitest_1.expect)(r.attempts).toHaveLength(2);
+        (0, vitest_1.expect)(r.attempts[0].success).toBe(false);
+        (0, vitest_1.expect)(r.attempts[0].testRan).toBe(true);
+        (0, vitest_1.expect)(r.attempts[0].testPass).toBe(false);
+        (0, vitest_1.expect)(r.attempts[1].intent).toContain("项目测试失败");
+        (0, vitest_1.expect)(r.attempts[1].intent).toContain("token 无效");
+        (0, vitest_1.expect)(r.attempts[1].testPass).toBe(true);
+        (0, vitest_1.expect)(mockRunProjectTests).toHaveBeenCalledTimes(2);
+    });
+    (0, vitest_1.it)("P2 上下文：includeContext 时意图注入 git 上下文，审计含 perception 事件", async () => {
+        mockExecute.mockResolvedValue(okResult());
+        const r = await (0, agent_loop_1.runAgentLoop)({
+            projectPath: "/tmp/fake-project",
+            intent: "实现登录流程",
+            filePath: "login.ts",
+            includeContext: true,
+        });
+        (0, vitest_1.expect)(r.success).toBe(true);
+        (0, vitest_1.expect)(r.attempts[0].intent).toContain("[项目上下文");
+        (0, vitest_1.expect)(r.attempts[0].intent).toContain("main");
+        const events = r.auditTrail.map((e) => e.event);
+        (0, vitest_1.expect)(events).toContain("perception:git");
+        (0, vitest_1.expect)(events).toContain("perception:ir");
+        (0, vitest_1.expect)(r.gitContext?.branch).toBe("main");
+        (0, vitest_1.expect)(r.irDelta).toBeDefined();
+    });
+    (0, vitest_1.it)("P2 感知：IR 增量写入审计轨迹并返回", async () => {
+        mockExecute.mockResolvedValue(okResult());
+        mockExtractIRWithDelta
+            .mockReturnValueOnce({ ir: [{ name: "verify_password" }], delta: { added: [], removed: [], functionCount: 1 } })
+            .mockReturnValueOnce({
+            ir: [{ name: "verify_password" }, { name: "main" }],
+            delta: { added: ["main"], removed: [], functionCount: 2 },
+        });
+        const r = await (0, agent_loop_1.runAgentLoop)({
+            projectPath: "/tmp/fake-project",
+            intent: "实现登录流程",
+            filePath: "login.ts",
+        });
+        (0, vitest_1.expect)(r.success).toBe(true);
+        (0, vitest_1.expect)(r.irDelta?.added).toContain("main");
+        const events = r.auditTrail.map((e) => e.event);
+        (0, vitest_1.expect)(events.filter((e) => e === "perception:ir")).toHaveLength(2);
+    });
+});

package/dist/agent-patrol.js

@@ -0,0 +1,200 @@
+"use strict";
+/**
+ * Phase 12: Agent 免疫巡逻 (P4) —— 形态 B 第一版
+ *
+ * 监听/扫描项目 → trust_check（Trust Engine 全量评估）→ 违规报告 + 建议补丁。
+ *
+ * 修复信任悖论（设计文档铁律）：
+ *   100% 检测精度 ≠ 修复正确率。巡逻第一形态**只报告 + 建议补丁，
+ *   绝不自动合并**（autoApplied 恒为 false）——修错比不修更糟，
+ *   第一份错误修复会摧毁"免疫巡逻"信任。
+ *
+ * 感知职责：每次扫描前强制重提 IR（IR_STALE 的消费方），保证验证的是新世界。
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runPatrol = runPatrol;
+exports.formatPatrolTerminal = formatPatrolTerminal;
+exports.formatPatrolMarkdown = formatPatrolMarkdown;
+exports.writePatrolReport = writePatrolReport;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const engine_1 = require("./trust/engine");
+const agent_perception_1 = require("./agent-perception");
+const extract_ir_1 = require("./extract-ir");
+// ── Main ──
+/**
+ * 运行一次免疫巡逻：重提 IR → evaluateTrust → 映射违规（含 fixPath）→ 报告。
+ */
+async function runPatrol(projectPath) {
+    const abs = path.resolve(projectPath);
+    const git = (0, agent_perception_1.collectGitContext)(abs);
+    // 感知：扫描前强制重提 IR（IR_STALE 消费方）——验证的是新世界
+    try {
+        const ir = (0, extract_ir_1.extractIR)(abs);
+        fs.writeFileSync(path.join(abs, "ir.json"), JSON.stringify(ir, null, 2));
+    }
+    catch { /* IR 提取失败不阻塞 —— trust 引擎会降级 */ }
+    const decision = await (0, engine_1.evaluateTrust)({
+        projectPath: abs,
+        projectName: path.basename(abs),
+        commit: git.available ? (git.recentCommits[0]?.split(" ")[0] || "unknown") : "unknown",
+        branch: git.available ? git.branch : undefined,
+    });
+    // fixPath 来自引擎的 violationTraces（BFS 修复路径）
+    const traces = new Map((decision.violationTraces || []).map((t) => [`${t.rule_id}|${t.file}|${t.function}`, t]));
+    const findings = decision.violations.map((v) => {
+        const trace = traces.get(`${v.rule_id}|${v.file}|${v.function}`);
+        return {
+            rule_id: v.rule_id,
+            severity: v.severity,
+            file: v.file,
+            function: v.function,
+            message: v.message,
+            fixPath: trace?.fixPath || [],
+            fix: v.fix,
+            evidence: v.evidence,
+            reasoningSteps: (trace?.steps || []).map((s) => `[${s.label}] ${s.action} → ${s.explanation}`),
+        };
+    });
+    const auditTrail = [
+        {
+            timestamp: new Date().toISOString(),
+            event: "patrol:scan",
+            detail: `decision=${decision.overall.decision} score=${decision.overall.score} ` +
+                `violations=${decision.violations.length}`,
+        },
+        {
+            timestamp: decision.timestamp,
+            event: "patrol:trust-audit",
+            detail: `checkId=${decision.auditTrail.checkId} engine=${decision.engineVersion} ` +
+                `reproducible=${decision.auditTrail.reproducible}`,
+        },
+    ];
+    return {
+        scannedAt: new Date().toISOString(),
+        project: decision.project,
+        branch: git.available ? git.branch : "",
+        commit: decision.commit,
+        decision: decision.overall.decision,
+        score: decision.overall.score,
+        confidence: decision.overall.confidence,
+        findings,
+        summary: {
+            total: decision.summary.total,
+            critical: decision.summary.critical,
+            high: decision.summary.high,
+            medium: decision.summary.medium,
+            low: decision.summary.low,
+        },
+        auditTrail,
+        engineVersion: decision.engineVersion,
+        checkId: decision.auditTrail.checkId,
+        autoApplied: false,
+        changedFiles: git.changedFiles,
+    };
+}
+// ── Formatters ──
+/** 终端一行摘要。 */
+function formatPatrolTerminal(r) {
+    const icon = r.decision === "APPROVED" ? "✅" : r.decision === "BLOCKED" ? "🛑" : "⚠️";
+    const lines = [
+        `${icon} 免疫巡逻: ${r.project} — ${r.decision} (score=${r.score}, confidence=${r.confidence})`,
+        `   违规: ${r.summary.total} (critical=${r.summary.critical} high=${r.summary.high} ` +
+            `medium=${r.summary.medium} low=${r.summary.low}) ｜ 自动合并: 永不（只报告+建议）`,
+    ];
+    for (const f of r.findings.slice(0, 10)) {
+        lines.push(`   [${f.severity}] ${f.rule_id} @ ${f.file}${f.function ? `::${f.function}` : ""}` +
+            (f.fixPath.length > 0 ? ` → 建议补丁: ${f.fixPath.join(" → ")}` : ""));
+    }
+    if (r.findings.length > 10)
+        lines.push(`   … 其余 ${r.findings.length - 10} 项见报告`);
+    return lines.join("\n");
+}
+/** 完整 Markdown 巡逻报告（含证据链回放，可入审计档案）。 */
+function formatPatrolMarkdown(r) {
+    const lines = [
+        `# 🛡️ Progmune 免疫巡逻报告`,
+        ``,
+        `- 扫描时间: ${r.scannedAt}`,
+        `- 项目: ${r.project}${r.branch ? `（分支 ${r.branch}）` : ""}`,
+        `- 提交: ${r.commit}`,
+        `- 决策: **${r.decision}** ｜ 分数: ${r.score} ｜ 置信度: ${r.confidence}`,
+        `- 引擎: ${r.engineVersion} ｜ checkId: ${r.checkId}`,
+        `- **自动合并: 永不**（只报告 + 建议补丁，修复需人工审批）`,
+        ``,
+        `## 违规摘要`,
+        ``,
+        `| 严重级 | 数量 |`,
+        `|---|---|`,
+        `| critical | ${r.summary.critical} |`,
+        `| high | ${r.summary.high} |`,
+        `| medium | ${r.summary.medium} |`,
+        `| low | ${r.summary.low} |`,
+        `| **合计** | **${r.summary.total}** |`,
+        ``,
+    ];
+    if (r.findings.length === 0) {
+        lines.push(`✅ 未发现违规。`, ``);
+    }
+    else {
+        lines.push(`## 违规明细与建议补丁`, ``);
+        r.findings.forEach((f, i) => {
+            lines.push(`### ${i + 1}. [${f.severity}] ${f.rule_id} — ${f.file}${f.function ? `::${f.function}` : ""}`, ``, `- **问题**: ${f.message}`, `- **修复建议**: ${f.fix}`);
+            if (f.fixPath.length > 0) {
+                lines.push(`- **建议补丁路径**（不自动应用）: \`${f.fixPath.join(" → ")}\``);
+            }
+            if (f.reasoningSteps.length > 0) {
+                lines.push(``, `**推理回放**:`, ``);
+                f.reasoningSteps.forEach((s) => lines.push(`  - ${s}`));
+            }
+            lines.push(``);
+        });
+    }
+    lines.push(`## 证据链（可回放）`, ``);
+    r.auditTrail.forEach((e) => lines.push(`- \`${e.timestamp}\` **${e.event}**: ${e.detail}`));
+    if (r.changedFiles.length > 0) {
+        lines.push(``, `## 扫描时变更文件`, ``);
+        r.changedFiles.forEach((f) => lines.push(`- ${f}`));
+    }
+    lines.push(``, `---`, `*由 Progmune 免疫巡逻生成。修复责任: 人工审批后应用。*`, ``);
+    return lines.join("\n");
+}
+/** 写入巡逻报告到项目目录，返回文件路径。 */
+function writePatrolReport(r, projectPath) {
+    const reportPath = path.join(path.resolve(projectPath), ".progmune_patrol_report.md");
+    fs.writeFileSync(reportPath, formatPatrolMarkdown(r), "utf-8");
+    return reportPath;
+}

package/dist/agent-patrol.test.js

@@ -0,0 +1,141 @@
+"use strict";
+/**
+ * Phase 12: 免疫巡逻测试 (P4)
+ *
+ * evaluateTrust / extractIR / git 全部 mock —— 验证：
+ *   - 违规 → 报告映射（fixPath 来自 violationTraces）
+ *   - autoApplied 恒为 false（修复信任悖论）
+ *   - Markdown 报告含建议补丁 + 证据链
+ *   - 报告落盘
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const engine_1 = require("./trust/engine");
+const extract_ir_1 = require("./extract-ir");
+const child_process_1 = require("child_process");
+const agent_patrol_1 = require("./agent-patrol");
+vitest_1.vi.mock("./trust/engine", () => ({
+    evaluateTrust: vitest_1.vi.fn(),
+}));
+vitest_1.vi.mock("./extract-ir", () => ({
+    extractIR: vitest_1.vi.fn(),
+}));
+vitest_1.vi.mock("child_process", () => ({
+    execSync: vitest_1.vi.fn(),
+}));
+const mockEvaluateTrust = vitest_1.vi.mocked(engine_1.evaluateTrust);
+const mockExtractIR = vitest_1.vi.mocked(extract_ir_1.extractIR);
+const mockExecSync = vitest_1.vi.mocked(child_process_1.execSync);
+/** 构造受控的 TrustDecision */
+function trustDecision(overrides = {}) {
+    return {
+        project: "demo-patrol",
+        commit: "abc123",
+        timestamp: "2026-08-21T08:00:00.000Z",
+        engineVersion: "trust-runtime-v1.0.0",
+        overall: { score: 41, decision: "BLOCKED", confidence: "HIGH" },
+        dimensions: {},
+        violations: [
+            {
+                severity: "high",
+                rule_id: "SSG_PROTOCOL",
+                file: "bad_flow.ts",
+                function: "bad_flow",
+                message: 'SSG state violation: "generate_jwt" requires states [PASSWORD_VERIFIED]',
+                evidence: "调用序列 [generate_jwt] 违反协议",
+                why: "缺少密码验证前置",
+                fix: "在 generate_jwt 前调用 verify_password",
+                policy_ref: "REF-SSG-001",
+            },
+        ],
+        violationTraces: [
+            {
+                rule_id: "SSG_PROTOCOL",
+                file: "bad_flow.ts",
+                function: "bad_flow",
+                steps: [
+                    { step: 1, label: "状态", action: "generate_jwt", preState: "UNAUTHENTICATED", explanation: "前置 PASSWORD_VERIFIED 缺失" },
+                ],
+                fixPath: ["verify_password"],
+                estimatedReadingTimeMinutes: 1,
+            },
+        ],
+        summary: { critical: 0, high: 1, medium: 0, low: 0, total: 1 },
+        auditTrail: {
+            commit: "abc123",
+            policy: "default",
+            policyVersion: "v1.0.0",
+            engineVersion: "trust-runtime-v1.0.0",
+            generatedAt: "2026-08-21T08:00:00.000Z",
+            reproducible: true,
+            checkId: "check_abc",
+        },
+        ...overrides,
+    };
+}
+(0, vitest_1.beforeEach)(() => {
+    vitest_1.vi.clearAllMocks();
+    mockExtractIR.mockReturnValue([]);
+    mockExecSync.mockImplementation((cmd) => {
+        const c = String(cmd);
+        if (c.includes("rev-parse"))
+            return "main";
+        if (c.includes("log --oneline"))
+            return "abc123 feat: demo";
+        if (c.includes("status --porcelain"))
+            return " M bad_flow.ts";
+        throw new Error("unexpected cmd: " + c);
+    });
+});
+(0, vitest_1.describe)("agent-patrol", () => {
+    (0, vitest_1.it)("违规映射到报告：fixPath 来自 violationTraces，autoApplied 恒为 false", async () => {
+        mockEvaluateTrust.mockResolvedValue(trustDecision());
+        const r = await (0, agent_patrol_1.runPatrol)("/tmp/fake-project");
+        (0, vitest_1.expect)(r.decision).toBe("BLOCKED");
+        (0, vitest_1.expect)(r.score).toBe(41);
+        (0, vitest_1.expect)(r.summary).toEqual({ critical: 0, high: 1, medium: 0, low: 0, total: 1 });
+        (0, vitest_1.expect)(r.findings).toHaveLength(1);
+        (0, vitest_1.expect)(r.findings[0].fixPath).toEqual(["verify_password"]);
+        (0, vitest_1.expect)(r.findings[0].reasoningSteps.length).toBe(1);
+        (0, vitest_1.expect)(r.autoApplied).toBe(false); // 铁律：永不自动合并
+        (0, vitest_1.expect)(r.auditTrail.map((e) => e.event)).toContain("patrol:scan");
+    });
+    (0, vitest_1.it)("无违规时 APPROVED 报告不含明细", async () => {
+        mockEvaluateTrust.mockResolvedValue(trustDecision({
+            overall: { score: 95, decision: "APPROVED", confidence: "HIGH" },
+            violations: [],
+            violationTraces: [],
+            summary: { critical: 0, high: 0, medium: 0, low: 0, total: 0 },
+        }));
+        const r = await (0, agent_patrol_1.runPatrol)("/tmp/fake-project");
+        (0, vitest_1.expect)(r.decision).toBe("APPROVED");
+        (0, vitest_1.expect)(r.findings).toHaveLength(0);
+        const md = (0, agent_patrol_1.formatPatrolMarkdown)(r);
+        (0, vitest_1.expect)(md).toContain("未发现违规");
+        (0, vitest_1.expect)(md).toContain("自动合并: 永不");
+    });
+    (0, vitest_1.it)("Markdown 报告含建议补丁路径与证据链回放", async () => {
+        mockEvaluateTrust.mockResolvedValue(trustDecision());
+        const r = await (0, agent_patrol_1.runPatrol)("/tmp/fake-project");
+        const md = (0, agent_patrol_1.formatPatrolMarkdown)(r);
+        (0, vitest_1.expect)(md).toContain("免疫巡逻报告");
+        (0, vitest_1.expect)(md).toContain("SSG_PROTOCOL");
+        (0, vitest_1.expect)(md).toContain("建议补丁路径");
+        (0, vitest_1.expect)(md).toContain("verify_password");
+        (0, vitest_1.expect)(md).toContain("推理回放");
+        (0, vitest_1.expect)(md).toContain("证据链（可回放）");
+        (0, vitest_1.expect)(md).toContain("checkId: check_abc");
+    });
+    (0, vitest_1.it)("writePatrolReport 落盘到项目目录", async () => {
+        const fs = require("fs");
+        const os = require("os");
+        const path = require("path");
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-patrol-"));
+        mockEvaluateTrust.mockResolvedValue(trustDecision());
+        const r = await (0, agent_patrol_1.runPatrol)(dir);
+        const reportPath = (0, agent_patrol_1.writePatrolReport)(r, dir);
+        (0, vitest_1.expect)(fs.existsSync(reportPath)).toBe(true);
+        const content = fs.readFileSync(reportPath, "utf-8");
+        (0, vitest_1.expect)(content).toContain("免疫巡逻报告");
+    });
+});