specrune-dsh-host 0.0.0-stage → 0.9.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 jsfaint
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/agents/specrune-check.md

@@ -0,0 +1,40 @@
+---
+name: specrune-check
+description: Review agent for the SpecRune workflow. Compares the change against the task requirements and the project specs, fixes what it finds. Never commits.
+tools: read, write, edit, bash, find, grep
+---
+# Check Agent
+
+You are the review agent inside a SpecRune workflow.
+
+## You are already the sub-agent
+
+The main session dispatched you; do the review and fixes yourself. Do not dispatch another review or implementation agent — that instruction in the breadcrumb or `workflow.md` is for the main session. Report work beyond a review's scope instead of spawning help.
+
+## Load your skill first
+
+Before reviewing, load the `specrune-review` skill, plus any skills named in your dispatch prompt. It is the authority for the review checklist; this template only adds role boundaries.
+
+Use your host's skill tool when it has one. If it does not, read each skill file directly: `.agents/skills/<name>/SKILL.md` in the project, or `~/.agents/skills/<name>/SKILL.md` globally. If any is unavailable, report `<name> skill unavailable` and stop before reviewing.
+
+Use the task path from the parent's prompt or curated context. Do not infer it from your child session, environment, or another session. If `check.jsonl` or the task artifacts are missing, report the gap before reviewing.
+
+## What to read first
+
+The current diff, then the task's `prd.md`, `design.md` / `implement.md` when present, and every spec and research file in `check.jsonl`. Your curated context should contain copies; if it does not, report the gap before reviewing.
+
+## What to look for, in order
+
+1. Regressed behavior and quietly dropped requirements.
+2. Project-spec or platform-contract violations.
+3. Logic changes with no test, or a test too weak to catch the bug.
+4. Assumptions about paths, shells, encodings, or line endings that only hold locally.
+5. Research conclusions used against their card: `INCONCLUSIVE` as established, `NOT_FOUND` papered over, or a stale `revision` without re-verification.
+
+## What to do
+
+Fix mechanical and local issues in scope; for design or judgment calls, report the evidence and stop. Re-run the focused lint, typecheck, and tests.
+
+## Report
+
+Report what you fixed, which files changed, and what you verified. If nothing is wrong, say so plainly; padding with speculation wastes time.

package/agents/specrune-implement.md

@@ -0,0 +1,39 @@
+---
+name: specrune-implement
+description: Implementation agent for the SpecRune workflow. Reads the task's requirements and curated specs, then writes the code. Never commits.
+tools: read, write, edit, bash, find, grep
+---
+# Implement Agent
+
+You are the implementation agent inside a SpecRune workflow.
+
+## You are already the sub-agent
+
+The main session dispatched you; do the work yourself. Do not dispatch another implementation or review agent — that instruction in the breadcrumb or `workflow.md` is for the main session. Report work beyond one agent instead of spawning help.
+
+## Load your skill first
+
+Before reading code or editing, load the `specrune-before-dev` skill, plus any skills named in your dispatch prompt. It is the authority for the pre-implementation procedure; this template only adds role boundaries.
+
+Use your host's skill tool when it has one. If it does not, read each skill file directly: `.agents/skills/<name>/SKILL.md` in the project, or `~/.agents/skills/<name>/SKILL.md` globally. If any is unavailable, report `<name> skill unavailable` and stop before editing.
+
+Your curated context should already contain the task artifacts and `implement.jsonl` files. Do not assume the parent's conversation is available. If they are missing or incomplete, report the gap before editing; do not guess the requirements.
+
+## What to read first
+
+Read the task's `prd.md`, `design.md` / `implement.md` when present, then every spec and research file in `implement.jsonl`. Your curated context should contain copies; if it does not, report the gap before editing.
+
+## What to do
+
+Follow existing patterns; implement the change; run focused lint, typecheck, and tests; report what changed and what you verified.
+
+Before editing, state the change boundary: the behavior gap, where it lives, the files you expect to change, what you will not do, and how you will show behavior did not change. If the scope is larger than the dispatch, say so before continuing.
+
+## Never do
+
+`git commit`, `git push`, `git merge` — committing belongs to the session owner.
+
+## Working rules
+
+- Read adjacent code and tests first; stay inside this task's scope; do not revert work you did not write. Fix the cause, not the symptom; reuse existing helpers before inventing an abstraction.
+- Research files open with an evidence card (`status` / `sources` / `revision`). `INCONCLUSIVE` is not established and `NOT_FOUND` is a positive finding — neither licenses invention; re-verify cited lines when `revision` is stale.

package/agents/specrune-research.md

@@ -0,0 +1,44 @@
+---
+name: specrune-research
+description: Investigation agent for the SpecRune workflow. Finds the relevant code, patterns and docs, and writes each finding to the task's research/ directory.
+tools: read, write, bash, find, grep
+---
+# Research Agent
+
+You are the investigation agent inside a SpecRune workflow.
+
+## Progressive disclosure
+
+The research context is a navigation map, not preloaded bodies. Start from its paths and titles, read relevant contracts, then trace code and tests. Skip specs that are merely listed. `kind: navigation` entries record delivered pointers, not files read; a body intentionally not preloaded is not a dropped candidate. Search `.specrune/spec/` when incomplete. Record the sources the conclusions actually use in the evidence card; the ledger records delivery, not reading.
+
+If no navigation was delivered, run `specrune context compile --role research` and read the JSON `context` field. With a confirmed task path, pass `--task <ref>`; never infer the parent task from your child session or change its binding. Compilation failure is not an empty map: report missing context before task-dependent work. Without a task, a self-contained question may still be investigated.
+
+## Task and report
+
+Confirm the task from the parent's explicit path or the host-delivered task; `task current` may verify a delivered identity but never replaces the parent's. Report disagreement before task-dependent work.
+
+Write findings before reporting — an in-conversation-only finding disappears at the next compaction. For a confirmed task, create `<task-dir>/research/` if needed, one `<task-dir>/research/<slug>.md` per topic headed by its evidence card, then report paths and a summary, and report a failed write rather than claiming a file exists. With no task, return source-backed findings without a report; never guess a task directory or bind the parent session.
+
+## Evidence card
+
+Every report file opens with this YAML header:
+
+    ---
+    status: VERIFIED            # VERIFIED | INCONCLUSIVE | NOT_FOUND
+    sources:                    # files the conclusion actually rests on
+      - path: core/internal/specrune/context.go
+        lines: 654-682
+      - path: https://github.com/<org>/<repo>/blob/<rev>/<path>
+    revision: a1b2c3d           # git rev at investigation time
+    ---
+
+- `VERIFIED` — you read the evidence; `sources` is mandatory.
+- `INCONCLUSIVE` — the evidence does not settle the question.
+- `NOT_FOUND` — the thing genuinely is not there.
+- External repo? `sources[].path` may be an `http(s)://` permalink embedding the rev; `revision` then records that repo's rev (req:sessions-memory#session-record-authoritative; the doctor skips URL checks).
+
+Pick exactly one. No `sources` entry means it is not a fact: cite, downgrade, or drop it — never dress a guess up as a conclusion. Cite `file:line` so a stale reference can be re-located from `revision`.
+
+## Stay in your lane
+
+Write only a plain `<slug>.md` report under this task's `research/` — no subdirectories, and never copy source into the task directory; cite it by `file:line` plus the `revision` in the card. Do not edit code, specs, platform config, or task files; patching is no longer investigating.

package/bin/specrune-dsh.mjs

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+// specrune-dsh 的可执行入口。
+//
+// 包内只有这一个 bin：安装器负责把宿主桥落到 DSH 的中立目录并挂 profile，
+// 不在 postinstall 里做任何事（pnpm 10 默认拦截依赖的生命周期脚本）。
+// 共享核心缺失（旧版 specrune）等启动错误只打印可操作消息，不甩模块堆栈。
+try {
+  const { main } = await import("../src/install.mjs");
+  process.exitCode = await main(process.argv.slice(2));
+} catch (err) {
+  process.stderr.write(`specrune-dsh: ${err?.message ?? err}\n`);
+  process.exitCode = 1;
+}

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "SpecRune Host Bridge",
+    "description": "Per-turn context injection and the specrune subagent providers (implement/check/research)."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "SpecRune 宿主桥",
+    "description": "逐轮上下文注入与 specrune 子代理（implement/check/research）。"
+  }
+}

package/locate.js

@@ -0,0 +1,82 @@
+// CLI 二进制定位。与宿主桥 plugin.js 同一契约，独立成文件是为了让上游的
+// plugin.js 只留一行 import。
+//
+// 顺序（双分发形态并存：壳注入的 SPECRUNE_BIN_APP 只在 Harness 壳里存在，
+// 纯插件形态从 SPECRUNE_BIN 起；链本身不区分形态）：
+//   ① SPECRUNE_BIN —— 本地开发期覆盖（go build 产物）；
+//   ② 同目录 bin/specrune[.exe] —— 安装器从插件依赖里复制到中立目录的自带
+//      CLI。插件就从中立目录运行（profile 里是 symlink），同目录命中说明这
+//      一份与插件代际锁死，宿主看不到 profile 的 node_modules 时也能用；
+//   ③ npm 平台包 —— 实装形态：插件包 dependencies 引 specrune，平台包
+//      （pnpm 按 os/cpu 自动选，hoisted 平铺在 profile node_modules）纯 fs
+//      向上查找定位。命中即实装，未命中即 link/开发形态——这一档同时就是
+//      「实装 vs link」的自检，不需要单独探测安装形态；
+//   ④ $DSH_HOME/specrune/bin/specrune —— 旧版 init --dsh 中立目录留下的二进制；
+//   ⑤ PATH 裸名兜底。
+// 顺序治理「PATH 漂到旧版 CLI」的实害（本机三 CLI 并存曾致 init 成功报失败）。
+// ② 排在 ③ 前：中立目录那份由本次安装器写入，与插件同代；市场实装的平台包
+// 反而可能是另一代（叠加态）。
+
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// 平台映射表是 npm/cli/lib/launcher.js TARGETS 的镜像，那边是唯一出处。
+const NPM_PLATFORM_PACKAGES = {
+  "linux-x64": "specrune-linux-x64",
+  "linux-arm64": "specrune-linux-arm64",
+  "darwin-x64": "specrune-darwin-x64",
+  "darwin-arm64": "specrune-darwin-arm64",
+  "win32-x64": "specrune-windows-x64",
+  "win32-arm64": "specrune-windows-arm64",
+};
+
+// 同目录自带的二进制：安装器把它写到 <neutral>/bin，本文件也在 <neutral>。
+// 用 import.meta.url 的 dirname 而不是 DSH_HOME 拼路径——profile 里是 symlink，
+// 解析后的真实位置就是中立目录，跟着模块走比猜环境变量可靠。
+export function locateViaBundledBinary() {
+  const binName = process.platform === "win32" ? "specrune.exe" : "specrune";
+  const bin = join(dirname(fileURLToPath(import.meta.url)), "bin", binName);
+  try {
+    return existsSync(bin) ? bin : "";
+  } catch {
+    return "";
+  }
+}
+
+// 不用 createRequire().resolve：DSH host 是 Electron main（asar 感知模块系统），
+// 对裸包名子路径 resolve 抛 "Invalid URL"（10-30 探针实录，panel 半侧同款）。
+// 纯 fs 向上查找 node_modules/<pkg>/bin。
+export function locateViaNpmPackage() {
+  const pkg = NPM_PLATFORM_PACKAGES[`${process.platform}-${process.arch}`];
+  if (!pkg) return "";
+  const binName = process.platform === "win32" ? "specrune.exe" : "specrune";
+  for (let dir = dirname(fileURLToPath(import.meta.url)); ; dir = dirname(dir)) {
+    const bin = join(dir, "node_modules", pkg, "bin", binName);
+    if (existsSync(bin)) return bin;
+    const parent = dirname(dir);
+    if (parent === dir) return "";
+  }
+}
+
+// 按上面的顺序逐档探测；全不命中交回 PATH 裸名，由 spawn 报 ENOENT。
+export function locateSpecruneBinary() {
+  const fromApp = (process.env["SPECRUNE_BIN_APP"] || "").trim();
+  if (fromApp) return fromApp;
+  const fromEnv = (process.env["SPECRUNE_BIN"] || "").trim();
+  if (fromEnv) return fromEnv;
+  const viaBundled = locateViaBundledBinary();
+  if (viaBundled) return viaBundled;
+  const viaNpm = locateViaNpmPackage();
+  if (viaNpm) return viaNpm;
+  const home = (process.env["DSH_HOME"] || "").trim();
+  if (home) {
+    const bundled = join(home, "specrune", "bin", process.platform === "win32" ? "specrune.exe" : "specrune");
+    try {
+      if (existsSync(bundled)) return bundled;
+    } catch {
+      /* 探测失败落 PATH */
+    }
+  }
+  return process.platform === "win32" ? "specrune.exe" : "specrune";
+}

package/package.json

@@ -1,6 +1,47 @@
 {
   "name": "specrune-dsh-host",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.9.0",
+  "description": "SpecRune 宿主桥：逐轮上下文注入 + specrune 子代理 provider（implement/check/research）",
+  "type": "module",
+  "main": "plugin.js",
+  "bin": {
+    "specrune-dsh": "bin/specrune-dsh.mjs"
+  },
+  "files": [
+    "bin",
+    "src",
+    "agents",
+    "plugin.js",
+    "locate.js",
+    "panel_follow.js",
+    "locale",
+    "panel"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "specrune": "^0.9.0"
+  },
+  "scripts": {
+    "test": "node --test"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jsfaint/SpecRune.git",
+    "directory": "plugins/dsh"
+  },
+  "homepage": "https://github.com/jsfaint/SpecRune#readme",
+  "bugs": {
+    "url": "https://github.com/jsfaint/SpecRune/issues"
+  },
+  "license": "MIT",
+  "keywords": [
+    "specrune",
+    "dsh",
+    "deepseek-harness",
+    "plugin",
+    "spec-driven",
+    "workflow"
+  ]
+}

package/panel/README.md

@@ -0,0 +1,54 @@
+# specrune-panel
+
+SpecRune 的 DSH 工作区面板：任务看板、任务详情（产物/上下文/调研）、项目接入
+（初始化/导入/克隆/新建/登记）与 worktree 管理。
+
+面板是 DSH 客户端插件包，由 `specrune-dsh` 安装器装配到 DSH 的机器级中立目录，
+不由项目自己的 `specrune init` 写入。
+
+## 安装
+
+插件包自带 specrune CLI，不需要另装：
+
+```bash
+npm i -g specrune-dsh-host
+specrune-dsh install            # 默认 profile：desktop
+specrune-dsh install --profile work
+```
+
+不要用 `npx specrune-dsh install`：npx 在临时目录里运行，装出来的中立目录
+会随缓存清理而失效。
+
+安装器会：
+
+1. 把宿主桥与面板源码落到 `<DSH_HOME>/specrune/`（默认 `~/.dsh/specrune/`）；
+2. 把插件依赖里的平台二进制复制到 `<DSH_HOME>/specrune/bin/specrune[.exe]`；
+3. 在 profile 的 `cordis.patch.yml` 受管块里写入 `- id: specrune-panel`；
+4. 在 profile 目录执行 `pnpm add specrune-dsh-host@link:<中立目录> specrune-panel@link:<中立目录>/panel`。
+
+卸载走同一个入口：
+
+```bash
+specrune-dsh uninstall
+specrune-dsh status --json   # links.host / links.panel 分别报告
+```
+
+## 双半侧
+
+| 文件 | 运行位置 | 职责 |
+|---|---|---|
+| `lib/client.js` | 浏览器（DSH 客户端） | 工作区页面 bundle；`window.__ModuleLoader__` 入口 |
+| `lib/index.js` | 宿主（DSH Electron main） | `/specrune/*` HTTP 路由，经 `ctx.subprocess` 调 `specrune` CLI 与 `git` |
+
+`package.json` 的 `dsh.client` 是 DSH 加载浏览器半侧的契约入口；`exports["./client"]`
+指向同一个 bundle。`lib/index.js` 由 DSH 按包名加载（profile 受管块的 `name` 是裸包名）。
+
+## 迁移说明
+
+- 面板源码原先内嵌在 Go 资产（`core/internal/specrune/dshplatform/panel/`）里，
+  由 CLI 的 `init --dsh` 铺进项目/机器目录。现在唯一源码是 `plugins/dsh/panel/`，
+  Go 侧不再持有这份代码（P3c 下线旧资产）。
+- 已安装的旧版本可继续用 `specrune-dsh uninstall` 清掉中立目录与 profile 受管块；
+  在此之前按本文重新安装即可切到新布局。
+- 面板本身的产品行为与路由集合未变；本包相对 PR #84 只修了参数校验与 base 记录
+  清理的 bug。