sillyspec 3.24.8 → 3.25.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sillyspec",
-  "version": "3.24.8",
+  "version": "3.25.1",
   "description": "SillySpec CLI — 流程状态机，让 AI 严格按步骤来",
   "icon": "logo.jpg",
   "homepage": "https://sillyspec.ppdmq.top/",

package/src/constants.js

@@ -80,3 +80,16 @@ export const SCAN_REQUIRED_DOCS = Object.freeze([
   'CONCERNS.md',
   'PROJECT.md',
 ])
+
+// ── 辅助 stage 清单（stage-contract 转移规则 与 stages/index 注册表 共用单一真相源）──
+// 曾在 stage-contract.js 与 stages/index.js 逐字重复定义，新增/调整辅助 stage 需同步改两处
+// 易分叉。现收敛一处。（注意：主流程序 STAGE_ORDER/mainFlowStages/flowStages 语义不同、
+// 各自用途正确，不在本清单范围。）
+export const AUXILIARY_STAGES = Object.freeze([
+  'scan',
+  'quick',
+  'explore',
+  'archive',
+  'status',
+  'doctor',
+])

package/src/contract-matrix.js

@@ -14,6 +14,7 @@ import {
   scanBackendEndpoints,
   scanFrontendApiCalls,
   normalizePath,
+  diffApiParity,
 } from './endpoint-extractor.js'
 import { parseTaskContracts } from './stages/plan-postcheck.js'
 
@@ -59,8 +60,12 @@ export function buildContractMatrix(planContent, changeDir) {
   const taskDeps = parseTaskDependencies(planContent)
 
   // 读取各 task 文档，分类 provider/consumer
+  // classify consumers（taskDeps keys）+ providers（deps 值）。
+  // 旧实现只 classify consumers → provider task 不在 keys 里 → providerClass 恒 undefined
+  // → contracts 恒空 → 端点契约管线（buildConsumerInjection / extractArtifactsForChange）全失效。
   const taskClasses = {}
-  for (const taskName of Object.keys(taskDeps)) {
+  const allTaskNames = new Set([...Object.keys(taskDeps), ...Object.values(taskDeps).flat()])
+  for (const taskName of allTaskNames) {
     const taskFile = join(changeDir, 'tasks', `${taskName}.md`)
     if (existsSync(taskFile)) {
       taskClasses[taskName] = classifyTask(readFileSync(taskFile, 'utf8'))
@@ -103,7 +108,9 @@ function parseTaskDependencies(planContent) {
   const deps = {}
 
   // 方式 1: 表格形式 | task-04 | ... | 01,02 |
-  const tableRows = planContent.matchAll(/\|[^|]*task-(\d+)[^|]*\|[^|]*\|[^|]*(?:task-)?(\d+(?:\s*[,，]\s*\d+)*)[^|]*\|/gi)
+  // 列前缀用 [^|\d]*（不吃数字）：旧 [^|]* 贪婪会吃掉 deps 列前导 0（" 01" → g2=1 → task-1），
+  // 导致 provider task-1.md 不存在 → contracts 恒空，端点契约管线失效。
+  const tableRows = planContent.matchAll(/\|[^|]*task-(\d+)[^|]*\|[^|]*\|[^|\d]*(?:task-)?(\d+(?:\s*[,，]\s*\d+)*)[^|]*\|/gi)
   for (const match of tableRows) {
     const task = `task-${match[1]}`
     const depList = match[2].split(/[,，\s]+/).map(d => `task-${d.trim()}`).filter(d => d.startsWith('task-'))
@@ -137,7 +144,9 @@ function parseTaskDependencies(planContent) {
 export function extractProviderArtifact(changeDir, worktreePath, specBase, taskName, runtimeRoot) {
   // 平台模式 contract-artifacts 落 runtimeRoot；否则落 specBase/.runtime
   const artifactRoot = runtimeRoot || join(specBase, '.runtime')
-  const artifactDir = join(artifactRoot, 'contract-artifacts', taskName)
+  // 跨变更隔离：contract-artifacts/<changeName>/<taskName>/，避免不同变更同名 task 互相覆盖污染对账
+  const changeName = changeDir ? basename(changeDir) : '_unknown'
+  const artifactDir = join(artifactRoot, 'contract-artifacts', changeName, taskName)
   const artifactPath = join(artifactDir, 'endpoints.json')
 
   if (!worktreePath || !existsSync(worktreePath)) {
@@ -171,6 +180,28 @@ export function extractProviderArtifact(changeDir, worktreePath, specBase, taskN
   }
 }
 
+/**
+ * 汇总提取一个变更内所有 provider task 的 endpoint artifact。
+ * run.js completeStep 在 execute Wave 完成时调用：扫 worktree → 按 buildContractMatrix 识别的
+ * provider task，各自落 contract-artifacts/<changeName>/<taskName>/endpoints.json。
+ * @param {{ changeDir: string, specBase: string, changeName: string, worktreePath: string|null }} args
+ * @returns {string|null} 日志摘要；无 provider/无 plan/worktree 缺失时返回 null（不打扰）
+ */
+export function extractArtifactsForChange({ changeDir, specBase, changeName, worktreePath }) {
+  if (!worktreePath || !changeDir || !existsSync(changeDir)) return null
+  const planFile = join(changeDir, 'plan.md')
+  if (!existsSync(planFile)) return null
+  const contracts = buildContractMatrix(readFileSync(planFile, 'utf8'), changeDir)
+  const providers = [...new Set(contracts.map(c => c.provider))]
+  if (providers.length === 0) return null
+  let withEndpoints = 0
+  for (const taskName of providers) {
+    const r = extractProviderArtifact(changeDir, worktreePath, specBase, taskName)
+    if (r.ok && r.endpoints.length > 0) withEndpoints++
+  }
+  return `📦 契约 artifact 提取: providers=${providers.join(',')}（${withEndpoints}/${providers.length} 含端点）`
+}
+
 // ─── Execute 阶段：前端 task 开始时注入契约 ─────────────────────────────
 
 /**
@@ -184,12 +215,13 @@ export function extractProviderArtifact(changeDir, worktreePath, specBase, taskN
 export function buildConsumerInjection(changeDir, specBase, taskName, contracts, runtimeRoot) {
   // 平台模式 contract-artifacts 落 runtimeRoot；否则落 specBase/.runtime
   const artifactRoot = runtimeRoot || join(specBase, '.runtime')
+  const changeName = changeDir ? basename(changeDir) : '_unknown'
   const myContracts = contracts.filter(c => c.consumer === taskName)
   if (myContracts.length === 0) return null
 
   const parts = []
   for (const contract of myContracts) {
-    const artifactDir = join(artifactRoot, 'contract-artifacts', contract.provider)
+    const artifactDir = join(artifactRoot, 'contract-artifacts', changeName, contract.provider)
     const artifactFile = join(artifactDir, 'endpoints.json')
 
     let endpoints = []
@@ -295,15 +327,16 @@ export function buildContractFieldInjection(changeDir, taskName) {
  * verify 阶段执行 API parity check
  * @param {string} specBase - .sillyspec 目录
  * @param {string} worktreePath - worktree 路径
- * @returns {{ ok: boolean, missingBackend: Array, unusedBackend: Array, summary: string }}
+ * @returns {{ ok: boolean, missingBackend: Array, unusedBackend: Array, summary: string, backendCount: number, frontendCount: number }}
  */
-export function verifyApiParity(specBase, worktreePath, runtimeRoot) {
-  const { diffApiParity } = require('./endpoint-extractor.js')
-
+export function verifyApiParity(specBase, scanRoot, runtimeRoot, changeName = null) {
   // 平台模式 contract-artifacts 落 runtimeRoot；否则落 specBase/.runtime
   const artifactRoot = runtimeRoot || join(specBase, '.runtime')
-  // 读取所有 provider artifacts
-  const artifactBase = join(artifactRoot, 'contract-artifacts')
+  // 读取该变更的所有 provider artifacts（contract-artifacts/<changeName>/*/endpoints.json）。
+  // changeName 缺失时回退扫顶层 contract-artifacts（CLI contractScan 跨变更场景兼容）。
+  const artifactBase = changeName
+    ? join(artifactRoot, 'contract-artifacts', changeName)
+    : join(artifactRoot, 'contract-artifacts')
   const allProviderEndpoints = []
 
   if (existsSync(artifactBase)) {
@@ -325,17 +358,12 @@ export function verifyApiParity(specBase, worktreePath, runtimeRoot) {
     }
   }
 
-  // 扫描前端调用
-  if (!worktreePath || !existsSync(worktreePath)) {
-    return {
-      ok: true,
-      missingBackend: [],
-      unusedBackend: [],
-      summary: 'No worktree to scan for parity check',
-    }
+  // 扫描前端调用（scanRoot 通常 = 主工作区 cwd：verify 时代码已 apply 到主工作区）
+  if (!scanRoot || !existsSync(scanRoot)) {
+    return { ok: true, missingBackend: [], unusedBackend: [], summary: 'No scan root for parity check', backendCount: allProviderEndpoints.length, frontendCount: 0 }
   }
 
-  const frontendCalls = scanFrontendApiCalls(worktreePath)
+  const frontendCalls = scanFrontendApiCalls(scanRoot)
   const { missingBackend, unusedBackend } = diffApiParity(frontendCalls, allProviderEndpoints)
 
   const ok = missingBackend.length === 0
@@ -347,5 +375,5 @@ export function verifyApiParity(specBase, worktreePath, runtimeRoot) {
     summary += ` | ${unusedBackend.length} backend endpoints unused by frontend`
   }
 
-  return { ok, missingBackend, unusedBackend, summary }
+  return { ok, missingBackend, unusedBackend, summary, backendCount: allProviderEndpoints.length, frontendCount: frontendCalls.length }
 }

package/src/db.js

@@ -2,6 +2,11 @@ import initSqlJs from 'sql.js';
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs';
 import { basename, dirname, join } from 'path';
 
+// DB schema 版本（与 project.schema_version DEFAULT 对齐）。_createSchema 改动（加表/列/migration）时 bump，
+// 触发 .schema-version 戳失效 → 下次 init 重跑 _createSchema + _save（W4-H：高频读路径 gate/derive/status
+// 每次 new ProgressManager 都过 init，原无条件 _createSchema+_save 致每次整库 export+三段原子写）。
+const DB_SCHEMA_VERSION = 3;
+
 export class DB {
   constructor(dbPath) {
     this.dbPath = dbPath;
@@ -25,11 +30,21 @@ export class DB {
     this.db.run('PRAGMA foreign_keys = ON');
     this.db.run('PRAGMA synchronous = NORMAL');
 
-    // 5. 创建表结构
-    this._createSchema();
+    // 5. 创建表结构（仅当 schema 版本戳不匹配时——W4-H）：
+    //    schema 已最新则只 load 不写，省掉 _createSchema + _save 的整库 export + 三段原子写。
+    //    戳在但 db 缺表属"手动改 db"边角（SillySpec 不支持），_loadDatabase 的损坏检测兜底正常路径。
+    const versionPath = `${this.dbPath}.schema-version`;
+    let schemaCurrent = false;
+    try {
+      schemaCurrent = existsSync(versionPath)
+        && readFileSync(versionPath, 'utf8').trim() === String(DB_SCHEMA_VERSION);
+    } catch { /* 戳读取失败保守重跑 schema */ }
 
-    // 6. 保存到磁盘
-    this._save();
+    if (!schemaCurrent) {
+      this._createSchema();
+      this._save();
+      try { writeFileSync(versionPath, String(DB_SCHEMA_VERSION)); } catch { /* 戳写入失败不阻断，下次重跑 */ }
+    }
   }
 
   close() {
@@ -43,15 +58,20 @@ export class DB {
   transaction(fn) {
     if (!this.db) throw new Error('DB not initialized');
     this.db.run('BEGIN');
+    let result;
     try {
-      const result = fn(this.db);
+      result = fn(this.db);
       this.db.run('COMMIT');
-      this._save();
-      return result;
     } catch (err) {
-      this.db.run('ROLLBACK');
+      // fn 抛错或 COMMIT 失败：事务级回滚（此时事务确实活跃，ROLLBACK 有效）
+      try { this.db.run('ROLLBACK'); } catch { /* 事务可能已被 fn 内的错自动回滚 */ }
       throw err;
     }
+    // COMMIT 成功后才持久化。_save 失败时抛原生错（磁盘满/EPERM），不再被 catch 里
+    // 无效的 ROLLBACK 二级异常（"no transaction active"）掩盖——内存库已 commit，
+    // 下次 _save / close() 会落盘，调用方拿到的是准确的持久化错误而非被替换的误报。
+    this._save();
+    return result;
   }
 
   /** 获取底层 db 对象（供 progress.js 直接使用） */

package/src/endpoint-extractor.js

@@ -75,14 +75,96 @@ export function extractFastApiEndpoints(filePath) {
 }
 
 /**
- * 从目录递归扫描所有 Python router 文件的端点
+ * 从单个文件提取 Express（Node）路由端点。
+ * 支持 router/app.get|post|put|delete|patch("path") 与链式 router.route("path").<method>()。
+ * app.use("prefix", router) 的前缀只做同文件近似（跨文件追踪不在首版范围）。
+ *
+ * @param {string} filePath - 文件绝对路径
+ * @returns {Array<{ method: string, path: string, source: string, line: number }>}
+ */
+export function extractExpressEndpoints(filePath) {
+  const content = readFileSync(filePath, 'utf8')
+  const lines = content.split('\n')
+  const endpoints = []
+
+  // 同文件内最后一个 app.use("prefix", ...) 作为前缀近似
+  let routerPrefix = ''
+  for (const line of lines) {
+    const useMatch = line.match(/\bapp\.use\s*\(\s*["'`]([^"'`]+)["'`]/)
+    if (useMatch) routerPrefix = useMatch[1]
+  }
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    const m = line.match(/\b(?:app|router)\.(get|post|put|delete|patch)\s*\(\s*["'`]([^"'`]+)["'`]/i)
+    if (m) {
+      endpoints.push({ method: m[1].toUpperCase(), path: routerPrefix + m[2], source: filePath, line: i + 1 })
+      continue
+    }
+    const routeChain = line.match(/\.route\s*\(\s*["'`]([^"'`]+)["'`]/)
+    if (routeChain) {
+      // 链式 .route(path).get(h).put(h) —— 同行所有 method 配上 path
+      const chainPath = routerPrefix + routeChain[1]
+      for (const mm of line.matchAll(/\.(get|post|put|delete|patch)\s*\(/gi)) {
+        endpoints.push({ method: mm[1].toUpperCase(), path: chainPath, source: filePath, line: i + 1 })
+      }
+    }
+  }
+
+  return endpoints
+}
+
+/**
+ * 从单个文件提取 Spring（Java）端点。
+ * 支持 @GetMapping/@PostMapping/.../@PatchMapping 与旧式 @RequestMapping(value="path", method=RequestMethod.X)；
+ * 类级 @RequestMapping("api") 前缀合并（取文件内第一个作类前缀，近似）。
+ *
+ * @param {string} filePath - 文件绝对路径
+ * @returns {Array<{ method: string, path: string, source: string, line: number }>}
+ */
+export function extractSpringEndpoints(filePath) {
+  const content = readFileSync(filePath, 'utf8')
+  const lines = content.split('\n')
+  const endpoints = []
+
+  let classPrefix = ''
+  for (const line of lines) {
+    const cm = line.match(/@RequestMapping\s*\(\s*(?:value\s*=\s*)?["'`]([^"'`]+)["'`]/)
+    if (cm) { classPrefix = cm[1]; break }
+  }
+
+  const methodMap = { get: 'GET', post: 'POST', put: 'PUT', delete: 'DELETE', patch: 'PATCH' }
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    const shortMatch = line.match(/@(Get|Post|Put|Delete|Patch)Mapping\s*\(\s*(?:value\s*=\s*)?["'`]([^"'`]+)["'`]/i)
+    if (shortMatch) {
+      endpoints.push({ method: methodMap[shortMatch[1].toLowerCase()], path: classPrefix + shortMatch[2], source: filePath, line: i + 1 })
+      continue
+    }
+    const oldMatch = line.match(/@RequestMapping\s*\(\s*(?:value\s*=\s*)?["'`]([^"'`]+)["'`][^)]*?method\s*=\s*RequestMethod\.(\w+)/i)
+    if (oldMatch) {
+      endpoints.push({ method: oldMatch[2].toUpperCase(), path: classPrefix + oldMatch[1], source: filePath, line: i + 1 })
+    }
+  }
+
+  return endpoints
+}
+
+/**
+ * 从目录递归扫描后端端点（多框架）。
+ * 按扩展名分派：.py→FastAPI / .js,.ts→Express / .java→Spring。
+ * 保留 excludePatterns（向后兼容 opts）；filePattern 在多框架分派下不再适用。
  * @param {string} dir
- * @param {{ filePattern?: RegExp, excludePatterns?: RegExp[] }} opts
+ * @param {{ excludePatterns?: RegExp[] }} opts
  * @returns {Array<{ method: string, path: string, source: string, line: number }>}
  */
 export function scanBackendEndpoints(dir, opts = {}) {
-  const filePattern = opts.filePattern || /(?:router|routes|api|endpoint|controller)\.py$/i
-  const excludePatterns = opts.excludePatterns || [/__pycache__/, /node_modules/, /\.venv/, /test/i]
+  const excludePatterns = opts.excludePatterns || [
+    /^__pycache__$/, /^node_modules$/, /^\.venv$/, /^\.git$/, /^\.gradle$/,
+    /^(dist|build|target|out)$/i,
+    /test/i,
+  ]
 
   const results = []
   if (!existsSync(dir)) return results
@@ -93,9 +175,12 @@ export function scanBackendEndpoints(dir, opts = {}) {
       if (entry.isDirectory()) {
         if (excludePatterns.some(p => p.test(entry.name))) continue
         walk(full)
-      } else if (entry.isFile() && filePattern.test(entry.name)) {
+      } else if (entry.isFile()) {
+        const ext = extname(entry.name).toLowerCase()
         try {
-          results.push(...extractFastApiEndpoints(full))
+          if (ext === '.py') results.push(...extractFastApiEndpoints(full))
+          else if (ext === '.js' || ext === '.ts') results.push(...extractExpressEndpoints(full))
+          else if (ext === '.java') results.push(...extractSpringEndpoints(full))
         } catch {}
       }
     }
@@ -224,6 +309,7 @@ export function normalizePath(rawPath) {
     .replace(/\$\{[^}]+\}/g, '{param}')
     .replace(/:\w+/g, '{param}')
     .replace(/\$\w+/g, '{param}')
+    .replace(/\{[^}]+\}/g, '{param}')   // Spring {planId} / FastAPI {plan_id} → {param}
 }
 
 // ─── 对账 ───────────────────────────────────────────────────────────────

package/src/hooks/worktree-guard.js

@@ -258,16 +258,27 @@ function queryDbFirstCell(cwd, sql) {
     "if(!fs.existsSync(dbPath))process.exit(0);" +
     "import(lib).then(async m=>{const SQL=await m.default();" +
     "const db=new SQL.Database(fs.readFileSync(dbPath));const r=db.exec(sql);" +
-    "if(r.length&&r[0].values.length)process.stdout.write(String(r[0].values[0][0]??''));db.close()}).catch(()=>{});"
+    "if(r.length&&r[0].values.length)process.stdout.write(String(r[0].values[0][0]??''));db.close()}).catch(e=>{process.stderr.write('hook db query failed: '+String(e&&e.message||e));process.exit(1)});"
   try {
     return execFileSync(process.execPath, ['-e', script], {
       encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'pipe'],
     }).trim() || null
-  } catch { return null }
+  } catch (e) {
+    // DB 查询失败（db 损坏 / sql.js resolve 失败 / 子进程超时）：降级返回 null，调用方
+    //（readCurrentStage 等）对 null 走 fail-closed。补 warn 让 doctor/agent 能看到根因，
+    // 而非完全静默（子进程把诊断写到了 stderr，execFileSync 抛错时挂在 e.stderr 上）。
+    const detail = (e && e.stderr ? String(e.stderr).trim() : '') || (e && e.message) || 'timeout/crash'
+    console.warn('⚠️ sillyspec.db 查询失败，hook 降级 fail-closed: ' + detail)
+    return null
+  }
 }
 
 export { queryDbFirstCell as _queryDbFirstCellForTest };
-
+export {
+  matchReadonlyWhitelist as _matchReadonlyWhitelistForTest,
+  matchDangerBlacklist as _matchDangerBlacklistForTest,
+  isSingleCommandReadonly as _isSingleCommandReadonlyForTest,
+};
 /**
  * 从 sillyspec.db 读取 currentStage
  * 优先级：gate-status.json > sillyspec.db
@@ -472,7 +483,11 @@ function isSingleCommandReadonly(cmd, extraReadonlyCommands = []) {
     // node/npm/npx 需要进一步检查子命令
     if (cmdName === 'node' || cmdName === 'npm' || cmdName === 'npx') {
       const rest = parts.slice(1).join(' ')
-      return rest.includes('--version') || rest.includes('-v') && parts.length <= 3 || rest === 'run test' || rest.startsWith('test')
+      // 仅纯版本查询（`npm --version` / `node -v`，恰好两段）放行。
+      // 不能用 rest.includes('--version')：`npx any-pkg --version` 会执行 any-pkg，
+      // 旧实现因 && 优先级高于 || 使 --version 分支无长度约束，可绕过只读白名单。
+      const isBareVersionQuery = parts.length === 2 && (parts[1] === '--version' || parts[1] === '-v')
+      return isBareVersionQuery || rest === 'run test' || rest.startsWith('test')
     }
     return true
   }
@@ -531,8 +546,12 @@ function isSingleCommandDangerous(cmd) {
  * @returns {string[]}
  */
 function splitCommandParts(command) {
-  // 按管道和链式操作符拆分
-  return command.split(/(?:\|\|&&|&&|\|)/g).map(s => s.trim()).filter(Boolean)
+  // 按管道、链式操作符、语句分隔、重定向拆分。
+  // 必须覆盖 `||`/`&&`/`;`/`&`/`|`/`>`/`<`：否则 `echo foo; rm -rf x`、
+  // `cat f > /etc/passwd` 会被当成单一片段，首命令命中只读白名单 → 整条放行，
+  // 后半段的危险/写入操作绕过只读白名单与危险黑名单两道门。
+  // （`$(...)`/反引号命令替换需 shell-token 化，与零依赖风格冲突，暂不覆盖。）
+  return command.split(/\|\||&&|;|&|\||>|</g).map(s => s.trim()).filter(Boolean)
 }
 
 /**

package/src/index.js

@@ -9,6 +9,7 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'fs';
 import { writeAtomicSync } from './fs-atomic.js';
 import { join, resolve } from 'path';
+import { execSync } from 'child_process';
 import { cmdInit, getVersion } from './init.js';
 import { ProgressManager, resolvePlatformSpecDir } from './progress.js';
 import { detectLocalYaml } from './local-detect.js';
@@ -186,7 +187,6 @@ async function main() {
   function resolveEffectiveDir(baseDir) {
     if (existsSync(join(baseDir, '.sillyspec'))) return baseDir
     try {
-      const { execSync } = require('child_process')
       const gitRoot = execSync('git rev-parse --show-toplevel', {
         cwd: baseDir, encoding: 'utf8', timeout: 5000
       }).trim()
@@ -340,8 +340,8 @@ async function main() {
           for (const e of (c.errors || [])) console.log(`     ✗ ${e}`);
           for (const w of (c.warnings || [])) console.log(`     ⚠ ${w}`);
         }
-        for (const e of (envelope.errors || [])) console.log(`  ✗ ${e}`);
-        for (const w of (envelope.warnings || [])) console.log(`  ⚠ ${w}`);
+        // 顶层 errors/warnings 是各 check 的聚合，已在上面按 check 分组显示；不再重复打印——
+        // 非 json 是 agent 默认消费路径，重复文本纯耗 context（W1-J）。
       }
       process.exitCode = exitCode;
       break;
@@ -402,7 +402,7 @@ async function main() {
       const { runCommand } = await import('./run.js')
       // 平台模式（--spec-dir 已指定）时，--dir 是明确的 source_root，不应被 resolveEffectiveDir 纠正
       const effectiveDir = specDir ? dir : resolveEffectiveDir(dir)
-      await runCommand(filteredArgs.slice(1), effectiveDir, specDir)
+      await runCommand(filteredArgs.slice(1), effectiveDir, specDir, { json })
       break
     }
     // 顶层命令别名：转发 runCommand，与 case 'run': 路径行为一致。
@@ -513,7 +513,7 @@ async function main() {
       }
       // 否则：保持原有 prompt 驱动的 bash 自检流程
       const { runCommand } = await import('./run.js');
-      await runCommand([command, ...filteredArgs.slice(1)], doctorEffectiveDir, specDir);
+      await runCommand([command, ...filteredArgs.slice(1)], doctorEffectiveDir, specDir, { json });
       break;
     }
     case 'scan':
@@ -528,7 +528,7 @@ async function main() {
       const { runCommand } = await import('./run.js')
       const stageArgs = [command, ...filteredArgs.slice(1)]
       const effectiveDir = specDir ? dir : resolveEffectiveDir(dir)
-      await runCommand(stageArgs, effectiveDir, specDir)
+      await runCommand(stageArgs, effectiveDir, specDir, { json })
       break
     }
     case 'knowledge': {

package/src/machine-interface.js

@@ -125,10 +125,16 @@ export async function runGate(stage, changeName, { cwd, specBase, runtimeRoot }
     const currentStage = progress.currentStage || '';
     const checks = [];
 
+    // W4-G (D-008)：execute 阶段预计算 code evidence 一次，供 artifacts check（经 runValidators
+    // → validateExecuteOutputs）与下方 execute-evidence check 共享——避免各调一次 checkExecuteCodeEvidence
+    // 各 spawn 2 个 git 进程（gate execute 一次省 ≈ 60-200ms on Windows）。
+    const sharedEvidence = stage === 'execute' ? checkExecuteCodeEvidence(cwd, changeName) : undefined;
+
     // ── a. artifacts：阶段产物校验（全部阶段）──
     const r = runValidators(stage, cwd, changeName, {
       projectName: progress.project,
       specRoot,
+      ...(sharedEvidence ? { evidence: sharedEvidence } : {}),
     });
     checks.push({
       id: 'artifacts',
@@ -137,24 +143,24 @@ export async function runGate(stage, changeName, { cwd, specBase, runtimeRoot }
       warnings: r.warnings || [],
     });
 
-    // ── b. transition：状态转换合法性（信息性，不参与综合 ok）──
-    // 与 run.js:1727 同源：传 fromStageData 触发 failed_post_check 门控，避免 gate 的
-    // transition 结论与 completeStep 漂移（design §8「聚合语义漂移」风险对策）。
+    // ── b. transition：状态转换合法性（参与综合 ok，与 completeStep 硬阻断一致）──
+    // 与 run.js runStage 同源：传 fromStageData 触发 failed_post_check 门控。
+    // transition 必须参与 ok：否则 gate 返回 ok=true、exit 0，Agent 据此 --done 却被
+    // runStage 的 checkTransition 硬阻断（exit 1），gate/run 判定分裂（design §8 漂移）。
     const fromStageData = (progress.stages && currentStage && progress.stages[currentStage]) || undefined;
     const t = checkTransition(currentStage, stage, fromStageData ? { fromStageData } : {});
     checks.push({
       id: 'transition',
       ok: t.allowed,
-      informational: true,
       errors: t.allowed ? [] : [t.reason].filter(Boolean),
       warnings: [],
     });
 
     // ── c. execute 阶段追加 execute-evidence + task-reviews ──
-    // D-008@v1 去重：checkExecuteCodeEvidence 整个 runGate 只调一次，
-    // 结果同时供 execute-evidence check 的 data 与综合结论。
+    // D-008 + W4-G：checkExecuteCodeEvidence 整个 runGate 只调一次（顶部 sharedEvidence 预计算），
+    // 这里复用——真正落实去重（原注释声称"只调一次"但实现里 execute-evidence check 仍重复调了第二次）。
     if (stage === 'execute') {
-      const ev = checkExecuteCodeEvidence(cwd, changeName);
+      const ev = sharedEvidence;
       checks.push({
         id: 'execute-evidence',
         ok: ev.status !== 'unchanged',

package/src/progress.js

@@ -225,44 +225,6 @@ export class ProgressManager {
     };
   }
 
-  async writeGlobal(cwd, data) {
-    // SQL: UPDATE project + UPSERT changes status
-    const db = await this._ensureDB(cwd);
-    db.transaction((sqlDb) => {
-      const now = new Date().toISOString();
-
-      // UPSERT project 行
-      sqlDb.run(`
-        INSERT INTO project (id, name, schema_version, created_at, updated_at)
-        VALUES (1, ?, ?, ?, ?)
-        ON CONFLICT(id) DO UPDATE SET
-          name = excluded.name,
-          schema_version = excluded.schema_version,
-          updated_at = excluded.updated_at
-      `, [data.project || '', data._version || CURRENT_VERSION, now, now]);
-
-      // 同步 changes 表：确保 activeChanges 列表中的变更存在且为 active，
-      // 不在列表中的设为 archived
-      const activeChanges = data.activeChanges || [];
-      for (const cn of activeChanges) {
-        sqlDb.run(`
-          INSERT INTO changes (name, status, created_at, last_active)
-          VALUES (?, 'active', ?, ?)
-          ON CONFLICT(name) DO UPDATE SET status = 'active', last_active = excluded.last_active
-        `, [cn, now, now]);
-      }
-      if (activeChanges.length > 0) {
-        sqlDb.run(`
-          UPDATE changes SET status = 'archived'
-          WHERE status = 'active' AND name NOT IN (${activeChanges.map(() => '?').join(',')})
-        `, activeChanges);
-      } else {
-        // 没有活跃变更，将所有 active 归档
-        sqlDb.run("UPDATE changes SET status = 'archived' WHERE status = 'active'");
-      }
-    });
-  }
-
   // ── 变更级别状态 ──
 
   /**
@@ -658,20 +620,42 @@ export class ProgressManager {
       console.error(`❌ 变更 ${newName} 已存在`);
       return;
     }
-    // 重命名目录
+    // 先更新 DB，再重命名目录；FS 失败则回滚 DB，避免"目录已改名但 DB 旧名"的孤儿
+    // （旧实现 FS-first 无补偿：renameSync 成功后 DB transaction 抛 EPERM/EBUSY 会让
+    //  目录已是 newName、DB 仍是 oldName，read(两名) 都失联且无自动恢复）。
     const oldDir = this._changePath(cwd, oldName);
     const newDir = this._changePath(cwd, newName);
+    const now = new Date().toISOString();
+    try {
+      db.transaction((sqlDb) => {
+        sqlDb.run(`UPDATE changes SET name = ?, last_active = ? WHERE name = ?`, [newName, now, oldName]);
+      });
+    } catch (e) {
+      console.error(`❌ 重命名失败：更新数据库时出错（${e.message}）`);
+      return;
+    }
+    let renamed = true;
     if (existsSync(oldDir)) {
-      renameSync(oldDir, newDir);
+      try {
+        renameSync(oldDir, newDir);
+      } catch (e) {
+        renamed = false;
+        // FS 重命名失败：回滚 DB 恢复 oldName，保持 DB 与目录一致
+        try {
+          db.transaction((sqlDb) => {
+            sqlDb.run(`UPDATE changes SET name = ?, last_active = ? WHERE name = ?`, [oldName, now, newName]);
+          });
+          console.error(`❌ 重命名失败：移动目录出错（${e.message}），已回滚数据库`);
+        } catch (rollbackErr) {
+          // 回滚本身也失败：DB 是 newName、目录是 oldName，两端分裂且无自动恢复。
+          // 不能再撒谎"已回滚"——必须显式报错让用户跑 doctor 修复。
+          console.error(`❌ 重命名失败且数据库回滚也失败（状态分裂，需手动修复）：原错=${e.message} 回滚错=${rollbackErr.message}。请跑 sillyspec doctor --json`);
+        }
+      }
     } else {
       mkdirSync(newDir, { recursive: true });
     }
-    // 更新 DB
-    const now = new Date().toISOString();
-    db.transaction((sqlDb) => {
-      sqlDb.run(`UPDATE changes SET name = ?, last_active = ? WHERE name = ?`, [newName, now, oldName]);
-    });
-    console.log(`✅ 变更已重命名：${oldName} → ${newName}`);
+    if (renamed) console.log(`✅ 变更已重命名：${oldName} → ${newName}`);
   }
 
   /**
@@ -1835,9 +1819,16 @@ export class ProgressManager {
     const gatePath = this._runtimePath(cwd, 'gate-status.json');
 
     if (!rows || rows.length === 0 || rows[0].values.length === 0) {
-      // 无 execute/quick 阶段的活跃变更，删除 gate-status
+      // 无 execute/quick 阶段的活跃变更：写墓碑而非 unlink。unlink 失败（Windows 杀毒/索引占用）
+      // 会被空 catch 吞掉，陈旧 gate-status 残留 → hook 把 brainstorm 误当 execute 放行（fail-open）。
+      // 墓碑 {stage:null} 让 readCurrentStage 的 `gateStatus.stage` 为假 → 自动 fallback DB，语义等价删除但原子。
       if (existsSync(gatePath)) {
-        try { unlinkSync(gatePath); } catch {}
+        try {
+          this._ensureRuntimeDir(cwd);
+          writeAtomicSync(gatePath, JSON.stringify({ stage: null, tombstone: true, updatedAt: new Date().toISOString() }) + '\n');
+        } catch (e) {
+          console.warn(`⚠️ gate-status 墓碑写入失败（hook 可能读到陈旧缓存）: ${e.message}`);
+        }
       }
       return;
     }
@@ -1857,9 +1848,14 @@ export class ProgressManager {
     }
 
     if (!gateStage) {
-      // current_stage 为 NULL 的边界情况，等同于无 execute/quick
+      // current_stage 为 NULL 的边界情况，等同于无 execute/quick：同样写墓碑（见上 rationale）
       if (existsSync(gatePath)) {
-        try { unlinkSync(gatePath); } catch {}
+        try {
+          this._ensureRuntimeDir(cwd);
+          writeAtomicSync(gatePath, JSON.stringify({ stage: null, tombstone: true, updatedAt: new Date().toISOString() }) + '\n');
+        } catch (e) {
+          console.warn(`⚠️ gate-status 墓碑写入失败（hook 可能读到陈旧缓存）: ${e.message}`);
+        }
       }
       return;
     }