v0.6.0

v0.6.0

新功能

/dev-workflow mark —— 一条命令让插件在这个仓库里生效

scope: 'marked' 是为了让一个 profile 里的不同仓库各用各的策略。以前启用一个仓库只有一条路：照 status 打印的路径去手建 .dsh/dev-workflow.yml。那个路径有两个坑——.dsh/ 目录往往不存在，文件也没有内容可抄。

现在：

/dev-workflow mark      # 在项目根建好标记，连目录一起
/dev-workflow unmark    # 删掉它

建出来的文件是三行注释，说明自己是什么、内容不会被解析、怎么退出。可以直接提交，团队里其他人拉下来就同样生效。

# 只想在部分仓库里跑这套规则
# 1. 面板里把「作用于哪些仓库」设为「仅带标记的」
# 2. 在要启用的仓库里：
/dev-workflow mark
# 3. 确认：
/dev-workflow status     # 会显示 Scope: every marked repository / marked

面板上没有目录选择器，也不该有：面板写的是 profile 的配置值，而启用哪个仓库落的是仓库里的文件，两者不是同一层。这个设置只能是一条命令——现在它是一条命令了。

升级

dsh plugin --profile <profile> add @melosic/dsh-dev-workflow@0.6.0

没有破坏性变更。scope 的判定规则、守卫行为、配置文件结构都没有动，0.5.0 上的配置原样继续有效。已经在 marked 档并手动建过标记的仓库不需要任何操作。

已知问题

• gh pr merge / gh pr close 仍然没有守卫，因为它们不是发布动作。合并本身不做远端写，风险在合并之后。
• 标记文件的存在性每次调用都重新判断，但项目根的向上查找有进程内缓存。会话中先给父目录建 .git 再给子目录建标记，缓存可能导致判到旧根。

致谢

感谢 @Melosic 提出这个可用性问题——「最该安静的设置，最容易的处理方式是切回 all」，这句话说中了。

v0.5.0

中文 | English

v0.5.0

这一版没有改规则，改的是规则说话的方式，以及一个此前只能靠人记住的约定。

新增

• 两个 PR 同时在飞时，创建第二个就会提醒你。 从同一基线切出的两个分支都会在更新日志的未发布段落下面加行，各自对基线干净，后合并的那个才冲突。现在 gh pr create 之前会比对本地其它未合并分支，点名会冲突的分支与文件——这是合并顺序还没定下来时唯一能提醒的地方。判定用 git merge-tree，只写对象库，不碰工作区、索引与网络。

改进了什么

• 更新日志条目限定在一两句、120 字以内。此前的发布页是把逐条更新的长文原样搬过去，读者要先读完内部叙述才找得到「我升级要做什么」。
• 发布页改成交付说明：中英双语，除逐条更新外还写升级步骤、已知问题与致谢。只关心能不能升级的读者，看完前两段就够。
• gh pr create 读七节 PR 模板，段落名可以用 prSections 配置——用中文段落名的仓库不必再整体关掉触发器。
• 发版检查的三条约定可配置：哪些命令算发版、未发布段落叫什么、分类标题有哪些。
• scope: 'marked' 让规则只在项目根带 .dsh/dev-workflow.yml 的仓库生效。默认仍是 all：默认改成 marked 等于悄悄放过所有未标记的仓库，那是把安全检查降级伪装成默认值。
• git commit -a 的提交信息与文档检查改看 git diff HEAD。-a 在提交那一刻才填索引，命令执行前读索引会把一次正确的提交拦下来。
• 守卫与触发器现在能看见 timeout 120 <命令> 之类包装下的命令。
• 会话记忆的目标按 LRU 淘汰之外，会话桶本身也有了上限。

升级

dsh plugin --profile <profile> add @melosic/dsh-dev-workflow@0.5.0

• 配置无破坏性变更，现有 cordis.patch.yml 里的设置原样有效。
• DSH 版本要求未变（>=0.2.0-rc.2）。
• 想用新的 scope，在项目根放一个 .dsh/dev-workflow.yml 并把 scope 设为 marked；不设就是原来的行为。

已知问题

• gh pr merge 仍然没有守卫。冲突提醒发生在 PR 创建那一刻，是作者的问题；合并时再问已经晚了，这条留给后续版本。
• gh release create 不在发版检查的识别范围内，这是文档里「我们看不见什么」一节明确列出的边界。

致谢

感谢在本机反复落盘的整整一天里读过日志、提过反对意见、并坚持「先别发版，先看看还有什么可修」的人——这一版的十条里有七条来自那些反对意见。

Full Changelog: v0.4.2...v0.5.0

v0.5.0

This release changes no rule. It changes how the rules speak, and turns one
convention that used to live in somebody's memory into a check.

New

• When two pull requests are in flight, opening the second one now says so.
  Two branches cut from the same base both add a line under the same unreleased
  heading; each is clean against that base, and the second one to merge pays for
  the conflict. Before gh pr create, the local branches this one would conflict
  with are compared and named, along with the files — the one moment the merge
  order is still open to change. The check runs git merge-tree, which writes
  objects only: no worktree, no index, no network.

What improved

• Changelog entries are capped at a sentence or two and 120 characters. Release
  pages used to be the long-form changelog pasted verbatim; readers had to work
  through internal narration to find out what upgrade required of them.
• Release pages are now handoff notes: bilingual, covering upgrade steps,
  known issues and thanks alongside the itemised changes. A reader who only wants
  to know whether they can upgrade is done after the first two sections.
• gh pr create reads a seven-section template whose names are configurable
  through prSections, so a repository writing its pull requests in another
  language no longer has to switch the trigger off entirely.
• Three release contracts are configurable: which commands count as a release,
  what the unreleased heading is called, and which categories are allowed.
• scope: 'marked' enables the rules only in repositories whose root carries
  .dsh/dev-workflow.yml. The default stays all: making marked the default
  would silently stop checking every unmarked repository, which is a relaxed
  security default wearing a default's clothes.
• The message and documentation checks for git commit -a read git diff HEAD.
  -a fills the index at commit time, so reading the index before the command
  runs would block a correct commit.
• Guards and triggers now see through timeout 120 <command> and similar
  wrappers.
• Session memory caps apply to both the target map (LRU) and the session buckets
  themselves, so a long-lived process no longer keeps an empty bucket per ended
  session.

Upgrading

dsh plugin --profile <profile> add @melosic/dsh-dev-workflow@0.5.0

• No breaking configuration changes; existing settings in cordis.patch.yml
  keep working.
• The DSH version requirement is unchanged (>=0.2.0-rc.2).
• To use the new scope, put .dsh/dev-workflow.yml at the project root and set
  scope: marked; leaving it out keeps the previous behaviour.

Known issues

• gh pr merge still has no guard. The conflict warning belongs at creation
  time, where the author can act on it; asking at merge time is too late, and
  that gap is left for a later release.
• gh release create is not recognised by the release check. This is the
  boundary already listed in the documentation's "what we cannot see" section.

Thanks

To everyone who read logs, pushed back, and insisted on not cutting the release
before looking at what else could be fixed — seven of these ten items came out of
that pushback.

Full Changelog: v0.4.2...v0.5.0

v0.4.2

中文 | English

v0.4.2

新增

• 技能里写死的阈值现在由测试绑定。SKILL.md 说「标题最多 50 字符」、列 11 个 type、说 scope 可选，而这三项都能在面板里改——此前改完默认值，技能正文和守卫执行的规则就各说各话。现在测试读配置默认值并断言双语正文与之相符。
• docs/DEVELOPMENT.md 新增「会话状态与进度文件」：src/state.ts 是内存状态、进程结束即忘，.dev-docs/PROGRESS.md 是本机私有、不入库，两者不该混用。
• docs/CONFIGURATION.md 说明三档策略加 onFailure 就是 major/minor 的落地方式。

修复

• pnpm ci:checks 全绿时不出声，一次全过的运行和一次某项压根没跑成的运行在输出上无法区分。现在每项都打印 [ok] <名称> 或失败行。
• docs/TOKEN-BUDGET.md 的按需成本表写的是技能重写之前的文件大小。现在换成实测的正文长度，并写明它剥掉 frontmatter 之后计算，按文件字节数算会偏大。

升级

dsh plugin --profile <profile> add @melosic/dsh-dev-workflow@0.4.2

本次没有任何运行期行为变更，配置字段与默认值不变。

已知问题

• 无

v0.4.2

Added

• The thresholds written into the skill are now bound by a test. SKILL.md said "at most 50 characters", listed 11 commit types, and said scope is optional — all three are configurable in the panel, so changing a default used to leave the shipped spec and the rule the guard actually enforces disagreeing. A test now reads the configured defaults and asserts both language versions match.
• docs/DEVELOPMENT.md gained a section on session state versus progress files: src/state.ts is in memory and forgotten when the process exits, while .dev-docs/PROGRESS.md is private to the machine and not committed.
• docs/CONFIGURATION.md explains how the three-tier policy plus onFailure covers the major/minor distinction.

Fixed

• pnpm ci:checks said nothing when everything passed, so a fully green run was indistinguishable from one where a check never executed. Every check now prints [ok] <name> or a failure line.
• The on-demand cost table in docs/TOKEN-BUDGET.md quoted file sizes from before the skill rewrite. It now uses measured body lengths, and says they are measured after stripping the frontmatter — counting file bytes reads high.

Upgrade

dsh plugin --profile <profile> add @melosic/dsh-dev-workflow@0.4.2

No runtime behaviour changed and no configuration field or default moved.

Known issues

• None

Full Changelog: v0.4.1...v0.4.2

v0.4.1

中文 | English

v0.4.1

修复

• 设置面板把所有字段标成「当前不生效」。插件明明开着，页面从「文档同步」往下整片灰掉并标上「当前不生效」，让人以为规则全失效了。原因是依赖上级开关的控件用「上级的值等于 true」判断自己是否被读取，而 mode 的「开」是字符串 on 而不是布尔 true。现在每个上级开关记下它自己的「开」值再比较。

升级

dsh plugin --profile <profile> add @melosic/dsh-dev-workflow@0.4.1

配置字段与默认值不变；这是纯面板显示修复，不需要改任何配置。

已知问题

• 无

v0.4.1

Fixed

• The settings panel labelled every field "currently inactive". The plugin was on, yet the page was greyed out from Documentation Sync downward, which reads as "the rules are all disabled". A control that depends on a parent switch decided whether it was live by testing the parent against the boolean true, but mode's on-value is the string on. Each parent switch now records its own on-value and is compared against that.

Upgrade

dsh plugin --profile <profile> add @melosic/dsh-dev-workflow@0.4.1

No configuration field or default moved; this is a panel-display fix only.

Known issues

• None

Full Changelog: v0.4.0...v0.4.1

v0.4.0

中文 | English

v0.4.0

新增

• 技能补上「谁在做什么」与「守卫到哪儿为止」。开头一节说明三种角色（插件自动执行、AI 助手必须遵守、人类做决定）和三份文档的分工；新增「工具与守卫的边界」一节，写明守卫看的是工具参数而不是运行中的进程，各守卫可配置的粒度并不相同。这两块此前只存在于代码注释和 SECURITY.md 里，模型读技能时看不到。
• 提交信息一节补 scope 对照表与「同一变更两种写法」的示例；PR 一节补「评审者这一侧」；发布一节补「发版中断在半路」的恢复路径；CHANGELOG 一节补并发编辑的处置。
• client.js 进入类型检查。面板是手写的浏览器 JS，此前不在任何 tsconfig 里——宿主改了方法名，编译期毫无反应，要等用户打开一个空白面板才知道。现在 pnpm typecheck:client 在 CI 与发布前都会跑。

修复

• timeout 120 <命令> 让所有守卫和触发器都看不见被包住的命令。 timeout、nice、stdbuf、ionice、watch 不在包装词表里，程序名就成了包装词本身，于是 timeout 120 git push --force、timeout 120 rm -rf /、timeout 120 cat .env 全部放行。
• Windows 上的删除与擦盘全部放行。程序名按原样比较，而 PowerShell 写 Remove-Item -Recurse、cmd 写 rd /s /q、卷擦除是 format C:——一个都不命中。现在程序名统一小写比较，cmd 开关只在 cmd 内建命令上生效。
• 参数位置上的命令替换被吸收进外层命令。echo $(rm -rf /) 曾被读成「echo 带三个参数」这一条无害命令，替换里的程序从未被判定。
• sh -lc / bash -ec 这类短选项簇里的 -c 不被识别，于是 bash -lc 'rm -rf /' 把整个脚本当不透明参数放行。
• pnpm -r publish 与 pnpm --filter pkg publish 完全看不见：-r 会把工作区里每个包都推上去，而发版检查与对外守卫都不触发。
• git restore <path> 与 git checkout -f 丢弃本地改动却不被拦；git push --mirror 只命中对外推送，一旦放宽推送档位就连带绕过强推与删分支。
• 搜索类命令把自己的搜索词当成了要打开的文件——grep -rn "credentials" . 会被拒，而这恰好是「查密钥有没有进仓库」的那条命令。
• 递归删除一个操作数都没留下时静默放行（rm -rf $(cat list)）。
• 审计只记配置档位而非实际决策，也没有 callId；allow 档不计数不审计。

移除

• 删掉三项从未被任何代码读取的配置：rules.branchPattern、rules.commitPattern、docs.adrDir。它们只有声明、面板展示和一枚「当前不生效」徽标，没有任何行为。旧配置文件里留着这三项不会报错，只是被忽略。

升级

dsh plugin --profile <profile> add @melosic/dsh-dev-workflow@0.4.0

无破坏性变更：删掉的三项配置本来就不生效，删掉它们不改变任何行为。技能章节数由 28 增至 35。

已知问题

• 解释器内部仍不可见：node -e、python -c、eval 里的命令不会被守卫检查。这是词法层的固有限制，已写进 docs/SECURITY.md。

v0.4.0

Added

• The skill now explains who does what and where the guard stops. A new opening section covers the three roles (the plugin acts, the assistant must, the human decides) and the division between the three documents; a new section on tool and guard boundaries states that a guard inspects tool arguments rather than a running process, and that the configurable granularity differs per guard. Both existed only in code comments and SECURITY.md, which a model reading the skill never sees.
• A scope table and a worked bad/good pair in the commit section; a reviewer's-side section under pull requests; recovery paths for a release that stops half-way; and how to handle concurrent CHANGELOG edits.
• client.js is now typechecked. The panel is hand-written browser JS and was in no tsconfig, so a renamed host method produced no compile error — you found out by opening a blank panel. pnpm typecheck:client runs in CI and before publishing.

Fixed

• A timeout 120 <command> prefix hid the wrapped command from every guard and trigger. timeout, nice, stdbuf, ionice, and watch were missing from the wrapper list, so the wrapper word became the program name and timeout 120 git push --force, timeout 120 rm -rf /, timeout 120 cat .env all passed.
• Windows deletion and disk wiping passed entirely. Program names were compared verbatim, so PowerShell's Remove-Item -Recurse, cmd's rd /s /q, and format C: matched nothing.
• A command substitution in argument position was absorbed into the enclosing command: echo $(rm -rf /) was read as one harmless command with three arguments, and the inner program was never judged.
• A clustered shell flag (bash -lc, sh -ec) was not recognised as running a command string, so the whole script passed as one opaque argument.
• pnpm -r publish and pnpm --filter pkg publish were invisible — -r pushes every package in the workspace while neither the release check nor the outward guard fired.
• git restore <path> and git checkout -f discard local work without being guarded; git push --mirror matched only the outward push, so relaxing that tier also bypassed force-push and branch-delete.
• Search commands had their search expression treated as a filename, so grep -rn "credentials" . was denied — the very command you run to check whether a secret is committed.
• A recursive delete left with no operand passed silently (rm -rf $(cat list)).
• The audit recorded the configured tier rather than the actual decision, had no callId, and skipped the allow tier entirely.

Removed

• Three configuration fields that no code ever read: rules.branchPattern, rules.commitPattern, docs.adrDir. They had a declaration, a panel row, and a "currently inactive" badge, and no behaviour. Leaving them in an existing config file is harmless — they are ignored.

Upgrade

dsh plugin --profile <profile> add @melosic/dsh-dev-workflow@0.4.0

No breaking change: the three removed fields never took effect, so removing them changes nothing. The skill grew from 28 sections to 35.

Known issues

• Interpreter bodies remain invisible: a command inside node -e, python -c, or eval is not inspected. That is an inherent limit of the lexical layer and is documented in docs/SECURITY.md.

Full Changelog: v0.3.0...v0.4.0

v0.3.0

中文 | English

v0.3.0

新增

• 发版检查的四条规则各自可关：版本号须是 SemVer、须有 [Unreleased] 段、分类标题须是 Keep a Changelog 六类、预发布版本不得推 latest。此前规则全硬编码，想放宽一条只能把三个触发器整体关掉。默认值与原行为逐字相同。
• gitGuard.checkoutDiscard：丢弃工作区改动的档位。 git checkout -- <path>、git checkout .、git restore . 会丢掉未提交的改动，此前完全没有守卫。
• 密钥前缀库由四种扩到九种：新增 npm token、GitLab token、GitHub fine-grained token、JWT、Authorization 头里的 Bearer 值。
• 面板标注「尚未生效」的配置，与「只读」区分开。
• tests/ 与 scripts/ 终于参与类型检查（pnpm typecheck:tests）。
• pnpm ci:checks 由五项增至七项：新增镜像对成对变更、版本三处对齐。
• 新增集成用例 tests/chain.spec.ts、命令行为用例 tests/commands.spec.ts、词法层用例 tests/shell.spec.ts。

修复

这一版集中收掉了二十多条审计发现，都是「规则写在文档里、代码里没有」那一类：

• 触发器不再被守卫的询问吞掉。 默认档下 gh pr create 先被对外守卫以 ask 拦下，PR 标题与描述检查、发版的版本号与 CHANGELOG 检查一行都不评估；用户批准那次泛泛的确认后命令直接执行。现在触发器即使下游是 ask 也先完成评估，把发现合并进那道询问。
• 触发器「先记后问」改为「真问过才记」。 此前用户点「拒绝」后重跑同一条命令会直接放行——一次否决被降级成一次提醒。
• /dev-workflow off 的三处状态机缺陷：off 把命令自己也注销导致无法再 on；任何一次无关设置写入都会把插件重新激活；status 不区分运行期 off 与配置 off。
• git commit -am "..." 不再让提交信息检查静默失效。 短选项簇此前不认识，消息为 undefined，类型与 CHANGELOG 检查全部跳过，结论直接是 ok。
• 文档同步改为按「本次提交」判定。 此前按整个工作区判定：README 只改一半挂在工作区时，任何无关提交都被拦下；一条未暂存的 CHANGELOG 改动就能满足规则。
• shell 词法层的六种静默绕过：sudo -u root git push --force、sh -c "rm -rf /"、echo $(git push --force)、反引号、find / -exec rm -rf {} +。
• Windows 上敏感文件守卫对 shell 读取全部失效：\ 被无条件当转义符，type C:\Users\x\.env 匹配失败放行。
• grep/glob 的搜索模式不再被当成路径：此前 grep pattern=".env" 被硬拒，而这正是「查密钥有没有入库」的那条命令。
• 命令守卫的目标判定差一：rm -rf ~/*、rm -rf $HOME/*、rm -rf //、rm -r /etc 全部放行，而 rm -rf ~ 被拦。
• git 守卫的漏报：git restore .、git checkout . 完全无守卫；git push --mirror 只命中对外推送；yarn publish / bun publish 无任何守卫。
• 提示疲劳：每次 rebase 都问，连 --continue/--abort/--skip 也问；会话内记忆开关此前只护 git 守卫。
• pre-pr 与 pre-release 的识别盲区与误报：--fill 静默全过、git tag v$(cat VERSION) 误报非 SemVer、## v1.0.0 风格永远匹配不上、npm version patch 三层门禁全不触发。
• 审计与命中计数：action 记的是配置档位而非实际决策、没有 callId、写盘失败静默断档、allow 档不计数不审计。
• locale 切换后工具与命令描述停在旧语言。
• 无 git 或非仓库时文档检查静默消失，现在降级事实作为 warning 进入结论。

升级

dsh plugin --profile <profile> add @melosic/dsh-dev-workflow@0.3.0

无破坏性变更。新增的 releaseCheck.* 与 gitGuard.checkoutDiscard 默认值复现旧行为。

已知问题

• 解释器内部（node -e、python -c、eval）仍不被检查，这是词法层的固有限制。

v0.3.0

Added

• The four release rules are now individually switchable: the version must be SemVer, an [Unreleased] section must exist, category headings must be the Keep a Changelog six, and a prerelease must not go to latest. Previously the rules were hardcoded and the only way to relax one was to turn off all three triggers. Defaults reproduce the old behaviour exactly.
• gitGuard.checkoutDiscard covers discarding working-tree changes: git checkout -- <path>, git checkout ., git restore . had no guard at all.
• The secret prefix library grew from four patterns to nine: npm tokens, GitLab tokens, GitHub fine-grained tokens, JWTs, and Bearer values in an Authorization header.
• Fields that do not take effect are now marked as such in the panel, distinct from "read-only".
• tests/ and scripts/ finally participate in typechecking (pnpm typecheck:tests).
• pnpm ci:checks grew from five guards to seven: mirrored pairs must change together, and the package version must have a matching changelog heading.
• New integration, command-behaviour, and lexer test suites.

Fixed

This release closes twenty-odd audit findings, all of the "the rule is in the docs but not in the code" kind:

• A guard's prompt no longer swallows the convention checks. Under the default configuration gh pr create was stopped by the outward guard with ask before the PR title, description, version, and CHANGELOG checks were evaluated at all — approving the generic prompt ran the command unchanged. Triggers now evaluate even when the downstream answer is ask, and merge their findings into that one prompt.
• A trigger now remembers only when it actually asked. After a rejection, re-running the same command passed silently — a one-time veto had been downgraded to a one-time reminder.
• Three /dev-workflow off state-machine defects: off unregistered the command itself so on was unknown; any unrelated settings write reactivated the plugin; status did not distinguish a runtime off from a configured off.
• git commit -am "..." no longer silently disables the message checks. Clustered short options were not parsed, the message came back undefined, and the type and CHANGELOG checks were skipped with an ok verdict.
• Documentation sync is judged against this commit, not the whole working tree. A half-finished README used to block any unrelated commit, and an unstaged CHANGELOG edit satisfied the rule without being committed.
• Six silent lexer bypasses: sudo -u root git push --force, sh -c "rm -rf /", echo $(git push --force), backticks, and find / -exec rm -rf {} +.
• The sensitive-file guard did not work for shell reads on Windows: a backslash was treated as an escape unconditionally, so type C:\Users\x\.env failed to match and passed.
• A grep/glob search expression is no longer treated as a path — grep pattern=".env" was hard-denied, which is exactly the command you run to check whether a secret is committed.
• The destructive-command target check was off by one, so rm -rf ~/*, rm -rf $HOME/*, rm -rf //, and rm -r /etc all passed while rm -rf ~ was caught.
• Missing git guards: git restore . and git checkout . had none; git push --mirror matched only the outward tier; yarn publish and bun publish matched nothing.
• Prompt fatigue: every rebase asked, including --continue/--abort/--skip; the in-session memory switch only covered the git guard.
• pre-pr and pre-release blind spots and false positives: --fill passed silently, git tag v$(cat VERSION) was reported as not SemVer, the ## v1.0.0 changelog style never matched, and npm version patch triggered none of the three gates.
• Audit and hit counting: action recorded the configured tier rather than the actual decision, there was no callId, write failures were silent, and the allow tier was not counted.
• Tool and command descriptions stayed in the old language after a locale switch.
• A missing or non-git directory made the documentation checks vanish silently; the degraded fact is now a warning in the outcome.

Upgrade

dsh plugin --profile <profile> add @melosic/dsh-dev-workflow@0.3.0

No breaking change. The new releaseCheck.* and gitGuard.checkoutDiscard defaults reproduce the old behaviour.

Known issues

• Interpreter bodies (node -e, python -c, eval) are still not inspected; that is an inherent limit of the lexical layer.

Full Changelog: v0.2.0...v0.3.0

v0.2.0

中文 | English

v0.2.0

新增

• 可视化设置面板。 插件在 DSH 设置里有了一张自己的卡片，32 项可直接改（开关与枚举，外加一个数字输入），9 项只读展示在折叠的「高级」区，另有 2 项只能改文件。面板没有自己的存储：保存写进当前 profile 的 cordis.patch.yml 并提交进运行中的配置，不需要重启。保存成功会在底部给一行提示——官方表单只报失败不报成功，而这张表单有 32 个字段。
• 四类安全守卫补齐。 v0.1.0 只有 git 守卫，其余三类此前只是写在文档里的承诺。现在都有了：命令守卫（rm -rf /、mkfs、dd 指向块设备、fork 炸弹、chmod -R 777 /）、敏感文件守卫（.env、*.pem、*.key、*.p12、.npmrc、secrets/ 等，命中即拒，理由里只说文件名与规则、从不打开文件）、密钥守卫（AWS / GitHub / Slack token 与私钥头，只报模式名，绝不回显匹配到的值）、审计记录（脱敏后逐行写入 .dev-docs/audit-log.jsonl）。
• 第五道守卫 outward-guard：拦下「本机没事、但别人立刻看得见」的动作。 此前四道守卫守的都是「东西会丢」，而 agent 抢在用户点头之前把分支推上去、把标签打上、把 PR 开出来、把版本发出去——本机一样东西都没丢，用户却已经被对外宣称同意了。四个策略键默认全为 ask（不是 deny：这是唯一一道本机不会造成任何损失的守卫，要的是同意而不是禁止）。
• PR 触发器与发版触发器。 三个约定触发器齐备：gh pr create 校验 PR 标题（直接复用提交信息检查——squash merge 后标题就是 main 上的提交信息）、描述的三段与未勾选的清单项；git tag / npm publish / pnpm publish 校验 SemVer、tag 与 package.json 版本是否一致、预发布是否被推到 latest、CHANGELOG 是否有 [Unreleased] 段与合法分类。
• gitGuard.rememberApproved：记住一次批准，同一操作本会话不再询问。 DSH 的审批是一次性的，守卫把 ask 交出去后看不到答案，所以开启后守卫自己发起审批、自己读结果：批准则放行并记进会话，拒绝 / 取消 / 无审批服务一律拒绝。按会话隔离，插件重新加载即清空，不落盘。
• 配置面补齐并全部标记为可变：新增九个字段，包括 commitCheck.onFailure（block / warn）、commitCheck.requireScope、docsCheck.requireReadmeOnConfig、docs.exclude。
• docs/ADR/ 从两份扩到五份，补上此前只在代码注释里存在的推理过程。

修复

• git push --force-with-lease 会短路掉强推判定：只要参数里有它就整表提前返回，于是 git push --force --force-with-lease 放行，而 plain --force 压过 lease 并真的覆盖远端。现在只有不带 --force / -f / +refspec 时 lease 才免检。
• 透明前缀使守卫看不见真实命令：sudo git push --force、nohup rm -rf /、npx npm publish 一律漏过。现在五道守卫共用一处修复。
• ${HOME} 永远匹配不上：rm -rf ${HOME} 被拆成无从判断的碎片。现在 ${VAR} 保留为一个词，rm -rf $HOME/、rm -rf ~/ 与 rm -rf / 一样命中。
• npm publish --dry-run 会被当成一次发布。现在对 --dry-run / -n 短路。
• PR 检查表把模板之外的复选框也算进去：作者自加的 ## Remaining work 段会被误判。现在只在模板要求的段落之内数。
• .env.example 被当成机密：示例文件按惯例不含真实凭据，且是仓库里最需要被读的文件之一。现在 example / sample / template / dist / defaults 五个变体放行。
• git push --delete 只是文档里的承诺：删远端分支既不问也不入审计。现在归 gitGuard.branchDelete 管，与本地 git branch -D 同一份损失、同一个策略键。

升级

dsh plugin --profile <profile> add @melosic/dsh-dev-workflow@0.2.0

这是 0.x 阶段的一次 MINOR 升级，可能包含破坏性变更。 对已装用户的实际影响：新增的三道守卫默认 enabled: true，因此 .env 之类的敏感文件读取从此会被拒绝；如果不希望如此，在面板或配置文件里关掉对应守卫。

已知问题

• minimumReleaseAge：应用内插件管理器走 pnpm 11，其默认值为 1440 分钟，所以新版本发布不到 24 小时时，不带版本号的安装会静默回退到上一版。指名版本安装可绕过。详见 docs/PUBLISHING.md。

v0.2.0

Added

• A visual settings panel. The plugin now has its own card in DSH settings: 32 fields are editable there (switches and enums, plus one number input), 9 are read-only in a collapsed Advanced section, and 2 can only be changed in the file. The panel has no storage of its own — saving writes to the current profile's cordis.patch.yml and commits it into the running configuration, no restart needed. A successful save shows a line at the bottom, because the official form reports failures only and this one has 32 fields.
• Three more guards. v0.1.0 had only the git guard; the other three were promises in the docs. Now they exist: a command guard (rm -rf /, mkfs, dd into a block device, fork bombs, chmod -R 777 /), a sensitive-file guard (.env, *.pem, *.key, *.p12, .npmrc, secrets/ — a deny that names the file and the rule and never opens the file), a secret guard (AWS / GitHub / Slack tokens and private-key headers, reporting only the pattern name and never the matched value), and an audit log (redacted, one JSON object per line in .dev-docs/audit-log.jsonl).
• A fifth guard, outward-guard, for actions that cost nothing locally but are visible to everyone immediately. The other four guard things that would be lost; this one covers the agent pushing a branch, creating a tag, opening a pull request, or publishing a version before the user has agreed — nothing local is lost, but the user has been spoken for. All four tiers default to ask rather than deny, because this is the one guard that cannot damage the machine; it wants agreement, not prohibition.
• Pull-request and release triggers. gh pr create checks the PR title (reusing the commit-message check, because a squash merge makes the title the commit message on main), the description sections, and unticked boxes; git tag, npm publish, and pnpm publish check SemVer, tag/manifest agreement, a prerelease going to latest, and the presence and categories of the [Unreleased] section.
• gitGuard.rememberApproved remembers one approval for the rest of the session. DSH approvals are one-shot and a guard cannot see the answer after handing ask over, so with this on the guard raises the approval itself and reads the result: allowed-once passes and is remembered; rejected, cancelled, or no approval service all deny. Per session, cleared on reload, never persisted.
• Nine new configuration fields, including commitCheck.onFailure (block / warn), commitCheck.requireScope, docsCheck.requireReadmeOnConfig, and docs.exclude.
• docs/ADR/ grew from two records to five.

Fixed

• git push --force-with-lease short-circuited the force-push check: its mere presence returned early, so git push --force --force-with-lease passed while the plain --force overrode the lease and really did overwrite the remote. The lease form is now exempt only when no --force / -f / +refspec is present.
• Transparent prefixes hid the real command: sudo git push --force, nohup rm -rf /, npx npm publish all slipped through. All five guards now share one fix.
• ${HOME} never matched: rm -rf ${HOME} was split into unusable fragments. ${VAR} now stays one word, and rm -rf $HOME/ and rm -rf ~/ match like rm -rf /.
• npm publish --dry-run was reported as a real release.
• The PR checklist counted boxes outside the template, so an author's own ## Remaining work section was misjudged. It now counts only inside the required sections.
• .env.example was treated as a secret; the example / sample / template / dist / defaults variants are now allowed.
• git push --delete was only a promise in the docs: deleting a remote branch neither asked nor audited. It now belongs to gitGuard.branchDelete — the same loss and the same policy key as a local git branch -D.

Upgrade

dsh plugin --profile <profile> add @melosic/dsh-dev-workflow@0.2.0

This is a MINOR bump during 0.x, so it may contain breaking changes. The practical effect on an existing install: the three new guards default to enabled: true, so reading something like .env is now denied. Turn the relevant guard off in the panel or the config file if you do not want that.

Known issues

• minimumReleaseAge: the in-app plugin manager runs pnpm 11, whose default is 1440 minutes, so an install without an explicit version silently falls back to the previous release for the first 24 hours after a publish. Naming the version works around it; see docs/PUBLISHING.md.

Full Changelog: v0.1.0...v0.2.0

v0.1.0

中文 | English

v0.1.0

新增

这是第一个可用版本。装上之后，agent 在提交、开 PR、发版之前会按项目工作流规范检查一遍，危险的 git 与 shell 命令会被拦下。

• 完整开发工作流规范，中英双语。 分支模型、提交信息规范、原子提交、PR 流程、文档同步、版本发布、CHANGELOG 维护、安全操作、自动触发时机。规范常驻成本只有一行目录条目，全文在模型主动读取时才支付。
• 两个检查工具：check_commit_message（Conventional Commits 校验，附带过长标题、句尾句号、过宽正文、缺 scope 等可忽略的软警告）与 check_doc_sync（成对文件只改一半时报错，代码变更未带文档或 CHANGELOG 条目时给警告）。
• 提交前触发器：agent 执行 git commit 时，把提交信息检查、变更文件检查与 feat 提交强制 CHANGELOG 合起来跑一遍，命中问题时给出双语提示。先调用链上后面的门禁，只在它返回 allow 之后才自查，绝不改判上游的决定。
• git 守卫：识别 force push、reset --hard、rebase、commit --amend、branch -D、clean -f、checkout -- <path> 与 --no-verify，按配置决定拒绝 / 询问 / 放行。没有任何一项默认 allow，插件自身也不默认拒绝任何操作。
• /dev-workflow 命令：on / off 切换插件，status 报告当前模式、locale、最近一次检查结果与守卫命中次数，check 按工作流规则即时检查整个工作区。
• 文档、ADR、测试套件（7 个 spec，107 个用例）与 CI 一起落地。

升级

dsh plugin --profile <profile> add @melosic/dsh-dev-workflow@0.1.0

首次安装。要求 DSH >=0.2.0-rc.1、Node.js >=20。

已知问题

• 只有 git 一道守卫；命令守卫、敏感文件守卫、密钥守卫与审计仍是文档里的承诺，v0.2.0 才落地。
• 只有提交前触发器；PR 与发版触发器尚未实现。

v0.1.0

Added

The first usable version. Once installed, the agent runs the project's workflow rules before committing, opening a pull request, or releasing, and dangerous git and shell commands are stopped.

• The full development workflow specification, in English and Chinese: branch model, commit messages, atomic commits, pull requests, documentation sync, releases, CHANGELOG maintenance, safe operations, and when the checks fire. The resident cost is one catalog line; the full text is paid for only when a model reads the skill.
• Two check tools: check_commit_message (Conventional Commits validation, plus ignorable advisories for an over-long subject, a trailing period, an over-wide body, and a missing scope) and check_doc_sync (an error when only half of a mirrored pair changed, a warning when a code change brings no documentation or CHANGELOG entry).
• A pre-commit trigger that runs the message check, the changed-file check, and the feat-requires-CHANGELOG rule together when the agent runs git commit, with a bilingual prompt on a finding. It calls the rest of the chain first and only checks after that returns allow, so it never overrules an upstream decision.
• The git guard: force push, reset --hard, rebase, commit --amend, branch -D, clean -f, checkout -- <path>, and --no-verify, decided per configuration. Nothing defaults to allow, and the plugin itself never denies anything by default.
• The /dev-workflow command: on / off, status (mode, locale, last outcome, guard hit counts), and check (evaluate the whole working tree now).
• Documentation, ADRs, a test suite (7 specs, 107 cases), and CI.

Upgrade

dsh plugin --profile <profile> add @melosic/dsh-dev-workflow@0.1.0

First install. Requires DSH >=0.2.0-rc.1 and Node.js >=20.

Known issues

• Only the git guard exists; the command, sensitive-file, and secret guards and the audit log are still promises in the docs, arriving in v0.2.0.
• Only the pre-commit trigger exists; the pull-request and release triggers are not implemented yet.

Full Changelog: v0.1.0