@agent_forge/forge-dsh 1.82.0 → 1.83.0

package/README.md

@@ -100,6 +100,9 @@ under `~/.dsh/profiles/<profile>/`):
     timeoutMs: 30000     # per-hook ceiling; timeout kills and FAILS OPEN
     startWaitMs: 1500    # first pre-step waits this long for session-start contexts
     welcome: true        # one first-turn line telling the user Forge is active (false = silent)
+    checkLatest: true    # /forge-status compares the plugin version with the registry's latest (false = never ask)
+    locale: auto         # language of the plugin's own messages: en | zh | auto (env FORGE_DSH_LOCALE, then system)
+    batch: auto          # one forge process per matcher group: auto (default, needs a forge of the plugin's own version) | true | false
     enabled: true        # false unwires every listener
     debug: false         # log fail-open hook errors to console.error
 ```
@@ -122,24 +125,64 @@ while the binary is missing, every hook attempt fails open on its own, so gates
 inactive whether or not the probe ran. Installing forge needs no host restart: the
 next session probes again and gating resumes.
 
-Two latency trade-offs to know: hooks run **serially** per event (up to six per
-group), so a slow hook chain delays the tool call — and a gate that legitimately
-exceeds `timeoutMs` (e.g. `auto-compile` cold-building a large project past 30s)
-silently loses that run's feedback to fail-open (visible in `/forge-status`).
-Raise `timeoutMs` on big projects.
-
-`/forge-status` reports the probe line after the header: `probe: ok (forge version …)`,
-`probe: FAILED — gates inactive (…)`, or `not run yet` before the process's first
-session start.
+Two latency points to know. A matched group can run as **one** `forge hook batch` process
+(forge runs the group's hooks in order and stops at the first block) instead of one process
+per hook — roughly 2.4× faster on a measured PreToolUse/Bash group (716ms vs 1720ms on a loaded
+dev machine). With the default `batch: auto` that happens only once the probe shows a forge of the
+plugin's own version: batch asks forge to pick the group by the plugin's matcher string, and a forge
+that disagrees would either print nothing on a block (older than the stdout fix) or silently run an
+empty group, so any other forge stays on the per-hook path, which depends on hook names only. `batch:
+true` forces batch **and gives that protection up** (with a mismatched forge a group can run empty without
+any error); use it only with a forge you know matches. `false` forces per-hook. Whatever the mode, a batch that fails is never taken as an
+allow: that group is re-run per hook for the call (hooks the batch already ran may run again;
+observation-only ones are de-duplicated by forge). Three failures in a row switch batch off; a batch
+that **times out** keeps just that group per-hook for ten minutes, then tries it again, because batch gives
+the whole group one `timeoutMs` and a single hung hook would otherwise starve the gates behind it. The
+three-failures count is per group. `/forge-status` shows
+all of this. And a gate that legitimately exceeds `timeoutMs` (e.g. `auto-compile` cold-building a large
+project past 30s) silently loses that run's feedback to fail-open (visible in `/forge-status`). Raise
+`timeoutMs` on big projects.
+
+A session whose gates keep failing open used to look healthy while checking nothing. After
+three fail-open runs in one session the plugin says so **once**, at the next Stop that is not
+already steering for a real block: how many runs lost their feedback, where to look
+(`/forge-status`) and what to raise (`timeoutMs`). It is advisory — nothing is blocked. The batch
+to per-hook downgrade is not counted: that run still executed its gates.
+
+The plugin delivers the bridge and (as a dependency) the forge CLI, **not the skill library**
+DSH reads from `~/.agents/skills`. When that directory holds no skill, the first-turn onboarding adds
+one line offering `forge skills install --global --target agents`; the model runs it only after
+the user agrees, since it writes the home directory. The offer is made once per host process, so
+a user who declines is not asked again at every new session. Resume, subagents and
+`welcome: false` sessions get no offer.
+
+Whether forge takes over a project is asked once per project — the same on every host. Forge
+does not infer consent from "the plugin is installed" (`init-suggest`'s `takeover` preference is
+the opt-in), so a DSH install behaves like a Claude Code plugin install here; the model relays
+the question from forge's own `init-suggest` advisory, which the receipt filter below never drops.
+
+Status-only receipts that forge prints when it has nothing to say (`no weakening detected`,
+`all skills SAFE`, `no .mcp.json` …) are dropped before injection — the host turns every allow
+context into a synthetic user message, and these carry no instruction. Anything else, including
+notes the plugin has never seen, passes through.
+
+`/forge-status` opens with `plugin: <installed>  latest: <registry>` — an old install keeps working but
+silently misses fixes, and this is the one place a user looks when something seems off. It is a single
+read-only request with a 3-second timeout, made only when the command runs (never at load or session
+start); offline, a private registry or an odd answer shows `unknown`, and `checkLatest: false` never asks.
+It also reports a `dispatch:` line (batch or per-hook) and the probe line after the
+header: `probe: ok (forge version …)`, `probe: FAILED — gates inactive (…)`, or `not run
+yet` before the process's first session start. It also lists wall time per interception
+point (runs, average, max) and each recent run's duration.
 
 ## Known watch items (dsh preview)
 
 - **No stop-hook loop guard** in the preview builds (`0.1.0-rc.7` – `0.2.1-rc.2`) —
   a permanently-failing Stop gate steers at every stop boundary. forge's Stop gates
   are self-limiting once their gate passes, but a stuck gate loops the turn.
-- **SessionStart context is best-effort** (emit mode, detached): it may miss the
-  first request of a very short-lived session — same limitation the official
-  bridges document (`TODO(session-start-gating)`).
+- **SessionStart context rides the first pre-step**: the detached run is awaited for at
+  most `startWaitMs`; a session whose first step arrives sooner than the run finishes
+  gets the context with its next step instead of the first.
 - DSH is a developer preview; pin this plugin's version alongside your dsh version.
 
 ## Development

package/lib/bundled.js

@@ -68,20 +68,3 @@ export function resolveBundledForge(opts = {}) {
     return undefined;
   }
 }
-
-/**
- * One line telling the agent where forge lives. The bundled binary is not on
- * PATH, while forge's own gate messages say `forge task start …`; gates are
- * driven by the agent, so it needs the absolute path to run them.
- *
- * @param {string} binPath - absolute path from resolveBundledForge.
- * @returns {string}
- */
-export function bundledForgeHint(binPath) {
-  const shown = /\s/.test(binPath) ? `"${binPath}"` : binPath;
-  return (
-    `[forge-dsh] forge CLI bundled with this plugin: ${shown}. It may not be on PATH — ` +
-    "when a gate message or the protocol tells you to run a `forge …` command, " +
-    `run it with this path instead of \`forge\`.`
-  );
-}

package/lib/decisions.js

@@ -18,7 +18,7 @@
  * @module decisions
  */
 
-import { runForgeHook } from "./runner.js";
+import { runForgeBatch, runForgeHook } from "./runner.js";
 import { pluginMessage } from "./tools.js";
 
 /**
@@ -26,6 +26,7 @@ import { pluginMessage } from "./tools.js";
  * @property {{reason: string, command: string}|undefined} blocked
  * @property {string[]} contexts - allow-path additionalContext, in order.
  * @property {string[]} errors   - fail-open infrastructure notes.
+ * @property {number} [durationMs] - wall time of the group run (for /forge-status).
  */
 
 /**
@@ -39,7 +40,8 @@ import { pluginMessage } from "./tools.js";
  */
 export async function runHookGroup(commands, payload, opts = {}) {
   const run = opts.runner ?? runForgeHook; // DI seam for tests
-  const outcome = { blocked: undefined, contexts: [], errors: [] };
+  const started = Date.now();
+  const outcome = { blocked: undefined, contexts: [], errors: [], durationMs: 0 };
   for (const command of commands) {
     const verdict = await run(command, payload, opts);
     if (verdict.error !== undefined) outcome.errors.push(`${command}: ${verdict.error}`);
@@ -49,6 +51,131 @@ export async function runHookGroup(commands, payload, opts = {}) {
     }
     if (verdict.context !== undefined) outcome.contexts.push(verdict.context);
   }
+  outcome.durationMs = Date.now() - started;
+  return outcome;
+}
+
+/**
+ * Status-only receipts forge prints when it has nothing to say ("no weakening
+ * detected", "all skills SAFE", "no .mcp.json" …). The host injects every
+ * allow-path context into the conversation as a synthetic user message, so each
+ * of these costs the model a turn-sized distraction for zero information. Only
+ * receipts confirmed to carry no instruction are listed; an allowlist of "what
+ * the model must see" would silently drop any new advisory, so unknown notes
+ * pass through. A note that tells anyone to DO something carries `Advisory:` or
+ * is a directive and never matches here.
+ *
+ * forge 在「无事可报」时输出的纯状态回执。宿主把 allow 路径的上下文注入成合成 user
+ * 消息，每条都白白占用模型一次注意力。只列已确认不含任何指令的回执；未知的一律放行
+ * （白名单会静默吞掉新增的 advisory）。要求任何人做事的提示带 `Advisory:` 或是指令，
+ * 不会命中这里。
+ */
+const QUIET_NOTES = [
+  /^\[assertion-check\] no weakening detected/,
+  /^\[auto-compile\] (?:no source touched|research-mode session)/,
+  /^\[skill-scan\] (?:all skills SAFE|no ~\/\.claude\/skills)/,
+  /^\[mcp-scan\] (?:no |\.mcp\.json unreadable|项目级 \.mcp\.json 无 config 层风险信号)/,
+  /^\[workflow-test-guard\] workflow 配置变更后 internal\/ci 守护测试全绿/,
+];
+
+/**
+ * Remove the quiet receipts from one context string. Judged per paragraph (a
+ * batch merges the group's contexts with a blank line between them); a paragraph
+ * is quiet when its first line matches. Returns "" when nothing is left.
+ *
+ * @param {string} text
+ * @returns {string}
+ */
+export function dropQuietNotes(text) {
+  return text
+    .split("\n\n")
+    .filter((paragraph) => !QUIET_NOTES.some((re) => re.test(paragraph)))
+    .join("\n\n");
+}
+
+/**
+ * Marks an outcome error as "this group ran per hook instead of batched" — the
+ * run still executed its gates, so it is a performance note, not a lost run, and
+ * the fail-open counter must not count it (index.js reads this prefix).
+ */
+export const BATCH_DOWNGRADE_MARK = "[batch→per-hook]";
+
+/** Consecutive unexplained batch failures of one group before batch is switched off for the process. */
+const BATCH_FAIL_LIMIT = 3;
+
+/** How long a group that timed out as a batch stays per-hook before batch is tried on it again. */
+const SLOW_RETRY_MS = 10 * 60 * 1000;
+
+/**
+ * Run the matched spec groups of one event — one `forge hook batch` process per
+ * group instead of one process per hook (the spec's matcher only SELECTS the
+ * group; forge owns the roster).
+ *
+ * Fail-open stays the invariant, with one guard: a batch that cannot answer is
+ * never taken as an allow. An error verdict ("exited with code 2 and no output"
+ * is what an older forge prints on a block) re-runs THAT group per hook — the
+ * legacy path whose contract every forge version honours. Two kinds of failure:
+ *   - a timeout: batch gives the whole group ONE ceiling, so a single hung hook
+ *     would starve every gate behind it. The group is re-run per hook (each hook
+ *     gets its own ceiling again) and stays per-hook for SLOW_RETRY_MS, so a
+ *     persistently slow group costs one stall, not one per tool call, while a
+ *     one-off hiccup (cold start, a virus scan) is not held against it forever;
+ *   - anything else: re-run per hook this once. Only BATCH_FAIL_LIMIT failures of
+ *     the SAME group in a row switch batch off for the process (a healthy group
+ *     must not keep resetting another group's streak); one success of that group
+ *     resets it, so a transient spawn error does not slow every later call.
+ * The re-run can execute hooks the batch already ran; observation-only hooks are
+ * de-duplicated by forge's idempotency window, blocking hooks simply run again.
+ *
+ * `opts.batch === false` forces per-hook from the start.
+ *
+ * @param {string} event - forge event name.
+ * @param {Array<{matcher: string, commands: string[]}>} groups - matched spec groups, spec order.
+ * @param {object} payload - Claude-Code-shape stdin payload.
+ * @param {object} [opts] - forgeBin/timeoutMs plus test seams `batchRunner`, `runner`, `batchState`.
+ * @returns {Promise<GroupOutcome>}
+ */
+export async function runMatchedGroups(event, groups, payload, opts = {}) {
+  const started = Date.now();
+  const batchRun = opts.batchRunner ?? runForgeBatch; // DI seam for tests
+  const state = opts.batchState ?? { broken: false };
+  state.slow ??= new Map(); // label -> when it timed out
+  state.failStreaks ??= new Map(); // label -> consecutive failures
+  const outcome = { blocked: undefined, contexts: [], errors: [], durationMs: 0 };
+  for (const group of groups) {
+    const label = `batch ${event}${group.matcher === "" ? "" : `/${group.matcher}`}`;
+    let part;
+    const slowSince = state.slow.get(label);
+    const isSlow = slowSince !== undefined && Date.now() - slowSince < SLOW_RETRY_MS;
+    if (opts.batch !== false && !state.broken && !isSlow) {
+      const verdict = await batchRun(event, group.matcher, payload, opts);
+      if (verdict.error === undefined) {
+        state.failStreaks.delete(label);
+        state.slow.delete(label);
+        part = {
+          blocked: verdict.block ? { reason: verdict.reason ?? "denied", command: label } : undefined,
+          contexts: verdict.context === undefined ? [] : [verdict.context],
+          errors: [],
+        };
+      } else if (verdict.timedOut === true) {
+        state.slow.set(label, Date.now());
+        outcome.errors.push(`${BATCH_DOWNGRADE_MARK} ${label}: ${verdict.error} — running this group's hooks one by one so a hung hook cannot starve the gates behind it`);
+      } else {
+        const streak = (state.failStreaks.get(label) ?? 0) + 1;
+        state.failStreaks.set(label, streak);
+        if (streak >= BATCH_FAIL_LIMIT) state.broken = true;
+        outcome.errors.push(`${BATCH_DOWNGRADE_MARK} ${label}: ${verdict.error} — running this group's hooks one by one`);
+      }
+    }
+    if (part === undefined) part = await runHookGroup(group.commands, payload, opts);
+    outcome.errors.push(...part.errors);
+    outcome.contexts.push(...part.contexts.map(dropQuietNotes).filter((text) => text !== ""));
+    if (part.blocked !== undefined) {
+      outcome.blocked = part.blocked;
+      break;
+    }
+  }
+  outcome.durationMs = Date.now() - started;
   return outcome;
 }
 

package/lib/index.js

@@ -25,6 +25,13 @@
  *               the forge bundled with this plugin (dependency, version-locked) >
  *               "forge" on PATH
  *   timeoutMs - per-hook ceiling, kill + fail open (default 30000)
+ *   locale    - language of the plugin's own messages: "en" | "zh" | "auto"
+ *               (default auto: env FORGE_DSH_LOCALE, then the system locale)
+ *   checkLatest - false stops /forge-status from asking the registry for the latest plugin
+ *               version (default true; one read-only GET, only when the command runs)
+ *   registry  - registry /forge-status asks (default https://registry.npmjs.org)
+ *   skillsHome - home directory whose .agents/skills is checked for the skill library
+ *               (default: the user's home; a seam for tests)
  *   welcome   - false drops the one-line first-turn onboarding (default true)
  *   startWaitMs - how long the first pre-step waits for the session-start
  *               contexts before moving on without them (default 1500)
@@ -34,14 +41,20 @@
  * @module @agent_forge/forge-dsh
  */
 import { readFileSync } from "node:fs";
-import { bundledForgeHint, resolveBundledForge } from "./bundled.js";
+import { resolveBundledForge } from "./bundled.js";
+import { compareVersions, fetchLatestVersion, isPlainVersion } from "./latest.js";
+import { messagesFor, resolveLocale } from "./messages.js";
+import { agentsSkillsInstalled } from "./skills.js";
 import { probeForge } from "./runner.js";
-import { runHookGroup, preExecuteDecision, postExecuteDecision, preStepDecision, prependStartContexts, turnStoppingOutcome } from "./decisions.js";
-import { buildEventPayload, buildToolPayload, matchedCommands, promptText, toCCToolName, welcomeText, isSubagent, MANAGED_BANNER } from "./tools.js";
+import { BATCH_DOWNGRADE_MARK, runMatchedGroups, preExecuteDecision, postExecuteDecision, preStepDecision, prependStartContexts, turnStoppingOutcome } from "./decisions.js";
+import { buildEventPayload, buildToolPayload, matchedGroups, pluginMessage, promptText, toCCToolName, isSubagent, MANAGED_BANNER } from "./tools.js";
 
 const spec = JSON.parse(readFileSync(new URL("./spec.json", import.meta.url), "utf8"));
 const pluginVersion = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
 
+/** Fail-open runs in one session before the degraded advisory fires. */
+const DEGRADED_AFTER = 3;
+
 /** Stable Cordis plugin name. */
 const name = "forge-quality";
 /** Hard dependency: the tool registry (pre/post-execute waterfalls). */
@@ -66,19 +79,40 @@ function apply(ctx, config = {}) {
   const opts = {
     forgeBin: explicitBin ?? bundledBin ?? "forge",
     timeoutMs: config.timeoutMs ?? 30000,
+    // One `forge hook batch` process per matcher group instead of one per hook (~half the
+    // per-tool-call latency). Config `batch`: true forces it, false forces the per-hook path,
+    // unset = auto — on only once the probe shows a forge of the plugin's own version. Batch asks
+    // forge to select the group by the plugin's matcher string, and an older or newer forge may
+    // not agree (an unmatched matcher is a silent empty allow, and forges before the stdout fix
+    // print nothing on a block), so a mismatched forge stays on the per-hook path, which only
+    // depends on hook names. Runtime failures degrade per call (see runMatchedGroups).
+    batch: config.batch === true,
+    batchState: { broken: false },
   };
+  const batchMode = config.batch === true ? "forced" : config.batch === false ? "off" : "auto";
   const debug = config.debug === true;
   const welcome = config.welcome !== false;
+  let skillsOffered = false;
+  const msg = messagesFor(resolveLocale(config.locale));
   const startWaitMs = Number.isFinite(config.startWaitMs) && config.startWaitMs >= 0 ? config.startWaitMs : 1500;
   // Recent-run ring buffer for /forge-status — fail-open verdicts are silent
   // by design, so this (plus debug logging) is the only way to see them.
   const recentRuns = [];
-  const noteErrors = (label, outcome) => {
+  const noteErrors = (label, outcome, agent) => {
+    // Per-session count of runs that lost their feedback to fail-open — the signal behind the
+    // one-time degraded advisory at Stop. The batch->per-hook downgrade note is not a lost run
+    // (the serial retry ran the gate), so it does not count.
+    // And nothing is counted while forge itself is missing: that is the missing-CLI notice's job,
+    // and "raise timeoutMs" would be the wrong advice.
+    const lost = lastProbe?.ok !== false && outcome.errors.some((e) => !e.startsWith(BATCH_DOWNGRADE_MARK));
+    const state = lost ? startStateOf(agent) : undefined;
+    if (state !== undefined) state.failOpen = (state.failOpen ?? 0) + 1;
     recentRuns.push({
       label,
       blocked: outcome.blocked?.command ?? null,
       contexts: outcome.contexts.length,
       errors: outcome.errors,
+      ms: outcome.durationMs ?? 0,
       at: Date.now(),
     });
     if (recentRuns.length > 50) recentRuns.shift();
@@ -137,12 +171,6 @@ function apply(ctx, config = {}) {
   let forgeReady = false;
   let lastProbe;
   let probeInFlight;
-  const missingForgeNotice = (error) =>
-    `[forge-dsh] forge CLI not found (forgeBin: ${opts.forgeBin}). ` +
-    "Forge gates are OFF for this session — every action runs unguarded (fail-open). " +
-    "Reinstall the plugin (it bundles forge) or run `npm install -g @agent_forge/forge`, then start a new session; " +
-    "if it lives elsewhere, set forgeBin in the profile patch." +
-    (error === undefined ? "" : `\nProbe error: ${error}`);
   const ensureForge = async (agent) => {
     if (forgeReady) return true;
     if (probeInFlight === undefined) {
@@ -166,32 +194,33 @@ function apply(ctx, config = {}) {
     lastProbe = probe;
     if (probe.ok) {
       forgeReady = true;
+      if (batchMode === "auto") opts.batch = (probe.version?.match(/\d+\.\d+\.\d+/) ?? [])[0] === pluginVersion;
       return true;
     }
     if (debug) console.error(`[forge-dsh] forge probe failed: ${probe.error}`);
     const state = startStateOf(agent);
     if (state !== undefined && !state.noticed) {
       state.noticed = true;
-      state.pending.push(missingForgeNotice(probe.error));
+      state.pending.push(msg.missingForge(opts.forgeBin, probe.error));
     }
     return false;
   };
 
   // PreToolUse — deny short-circuits the tool call.
   ctx.effect(() => ctx.on("tools/pre-execute", async (exec, next) => {
-    const commands = matchedCommands(spec.PreToolUse, toCCToolName(exec?.name ?? ""));
-    if (commands.length === 0) return next();
-    const outcome = await runHookGroup(commands, buildToolPayload(exec, "PreToolUse"), opts);
-    noteErrors("pre-execute", outcome);
+    const groups = matchedGroups(spec.PreToolUse, toCCToolName(exec?.name ?? ""));
+    if (groups.length === 0) return next();
+    const outcome = await runMatchedGroups("PreToolUse", groups, buildToolPayload(exec, "PreToolUse"), opts);
+    noteErrors("pre-execute", outcome, exec?.agent);
     return preExecuteDecision(outcome, exec?.agent, next);
   }), "forge: pre-execute");
 
   // PostToolUse — block turns the gate's reason into an error result.
   ctx.effect(() => ctx.on("tools/post-execute", async (exec, result, next) => {
-    const commands = matchedCommands(spec.PostToolUse, toCCToolName(exec?.name ?? ""));
-    if (commands.length === 0) return next();
-    const outcome = await runHookGroup(commands, buildToolPayload(exec, "PostToolUse"), opts);
-    noteErrors("post-execute", outcome);
+    const groups = matchedGroups(spec.PostToolUse, toCCToolName(exec?.name ?? ""));
+    if (groups.length === 0) return next();
+    const outcome = await runMatchedGroups("PostToolUse", groups, buildToolPayload(exec, "PostToolUse"), opts);
+    noteErrors("post-execute", outcome, exec?.agent);
     return postExecuteDecision(outcome, next, exec?.agent);
   }), "forge: post-execute");
 
@@ -199,16 +228,16 @@ function apply(ctx, config = {}) {
   ctx.effect(() => ctx.on("agent/pre-step", async (payload, next) => {
     const state = startStateOf(payload?.agent);
     const startWait = waitStart(state);
-    const commands = matchedCommands(spec.UserPromptSubmit, "");
+    const groups = matchedGroups(spec.UserPromptSubmit, "");
     let decision;
-    if (commands.length === 0) {
+    if (groups.length === 0) {
       decision = await next();
     } else {
       const eventPayload = buildEventPayload("UserPromptSubmit", payload?.agent, {
         prompt: promptText(payload?.messages),
       });
-      const outcome = await runHookGroup(commands, eventPayload, opts);
-      noteErrors("pre-step", outcome);
+      const outcome = await runMatchedGroups("UserPromptSubmit", groups, eventPayload, opts);
+      noteErrors("pre-step", outcome, payload?.agent);
       decision = await preStepDecision(outcome, next, payload?.agent);
     }
     await startWait;
@@ -242,14 +271,15 @@ function apply(ctx, config = {}) {
       if (source === "compact" && state !== undefined) state.hinted = false;
       if (forgeOk && binSource === "bundled" && state !== undefined && !state.hinted) {
         state.hinted = true;
-        state.pending.push(bundledForgeHint(opts.forgeBin));
+        state.pending.push(msg.bundledHint(opts.forgeBin));
       }
-      const start = await runHookGroup(
-        matchedCommands(spec.SessionStart, ""),
+      const start = await runMatchedGroups(
+        "SessionStart",
+        matchedGroups(spec.SessionStart, ""),
         buildEventPayload("SessionStart", agent, { source }),
         opts,
       );
-      noteErrors("session-start", start);
+      noteErrors("session-start", start, agent);
       queue(start);
       // Welcome — queue order: welcome, path hint, forge's own contexts. One
       // human-facing line per session: startup only (resume/compact are not a
@@ -262,15 +292,24 @@ function apply(ctx, config = {}) {
       if (forgeOk && welcome && isStartup && managed && !isSubagent(agent) && state !== undefined && !state.welcomed) {
         state.welcomed = true;
         const forgeVersion = (lastProbe?.version?.match(/\d+\.\d+\.\d+/) ?? [])[0];
-        state.pending.unshift(welcomeText(pluginVersion, forgeVersion));
+        state.pending.unshift(msg.welcome(pluginVersion, forgeVersion));
+        // The plugin brings the bridge and the forge CLI, not the skill library DSH reads from
+        // ~/.agents/skills; offer it (right behind the welcome) when that directory is empty.
+        // Once per plugin instance: there is no persisted "declined", so asking again at every
+        // new session would nag a user who already said no.
+        if (!skillsOffered && !agentsSkillsInstalled(config.skillsHome)) {
+          skillsOffered = true;
+          state.pending.splice(1, 0, msg.skillsHint(opts.forgeBin));
+        }
       }
       if (source === "compact") {
-        const compact = await runHookGroup(
-          matchedCommands(spec.PostCompact, ""),
+        const compact = await runMatchedGroups(
+          "PostCompact",
+          matchedGroups(spec.PostCompact, ""),
           buildEventPayload("PostCompact", agent, {}),
           opts,
         );
-        noteErrors("post-compact", compact);
+        noteErrors("post-compact", compact, agent);
         queue(compact);
       }
     })().catch((error) => {
@@ -286,13 +325,23 @@ function apply(ctx, config = {}) {
   // Stop — a blocking gate steers the agent into another step.
   ctx.effect(() => ctx.on("agent/turn-stopping", async (payload) => {
     const agent = payload?.agent;
-    const outcome = await runHookGroup(
-      matchedCommands(spec.Stop, ""),
+    const outcome = await runMatchedGroups(
+      "Stop",
+      matchedGroups(spec.Stop, ""),
       buildEventPayload("Stop", agent, { stop_hook_active: false }),
       opts,
     );
-    noteErrors("turn-stopping", outcome);
-    return turnStoppingOutcome(outcome, agent);
+    noteErrors("turn-stopping", outcome, agent);
+    const steering = await turnStoppingOutcome(outcome, agent);
+    // Fail-open is silent by design, so a session where gates keep timing out looks healthy while
+    // checking nothing. Once per session, at the first Stop that is not already steering for a
+    // real block, say so (advisory — it blocks nothing). The count is per session, not global.
+    const state = startStateOf(agent);
+    if (outcome.blocked === undefined && state !== undefined && (state.failOpen ?? 0) >= DEGRADED_AFTER && !state.degradedNoted) {
+      state.degradedNoted = true;
+      agent?.steer?.(pluginMessage(msg.degraded(state.failOpen)));
+    }
+    return steering;
   }), "forge: turn-stopping");
 
   // /forge-status — wired groups + verdict summary + recent runs (the only
@@ -327,9 +376,45 @@ function apply(ctx, config = {}) {
               const parts = [`  ${new Date(r.at).toISOString()} ${r.label}`];
               if (r.blocked) parts.push(`blocked-by=${r.blocked}`);
               if (r.contexts > 0) parts.push(`contexts=${r.contexts}`);
+              parts.push(`${r.ms}ms`);
               if (r.errors.length > 0) parts.push(`FAIL-OPEN: ${r.errors.join("; ")}`);
               return parts.join("  ");
             }).join("\n");
+        // Per-interception-point wall time over the ring buffer: the number behind "why is every
+        // tool call slow" (one batch spawn per group should sit well under the per-hook sum).
+        const byLabel = new Map();
+        for (const r of recentRuns) {
+          const t = byLabel.get(r.label) ?? { runs: 0, total: 0, max: 0 };
+          t.runs += 1;
+          t.total += r.ms;
+          t.max = Math.max(t.max, r.ms);
+          byLabel.set(r.label, t);
+        }
+        const timing = byLabel.size === 0
+          ? "  (no hook runs yet)"
+          : [...byLabel].map(([label, t]) => `  ${label}  runs=${t.runs}  avg=${Math.round(t.total / t.runs)}ms  max=${t.max}ms`).join("\n");
+        const forgeVersion = (lastProbe?.version?.match(/\d+\.\d+\.\d+/) ?? [])[0];
+        const slowGroups = opts.batchState.slow === undefined ? [] : [...opts.batchState.slow.keys()];
+        let dispatchLine;
+        if (batchMode === "off") dispatchLine = "per-hook (batch:false)";
+        else if (opts.batchState.broken) dispatchLine = "per-hook (batch failed three times in a row; restart the host to retry)";
+        else if (!opts.batch) {
+          dispatchLine = lastProbe === undefined
+            ? "per-hook (waiting for the first session start to check the forge version)"
+            : `per-hook (forge ${forgeVersion ?? "of unknown version"} != plugin ${pluginVersion}: batch needs a forge of the plugin's own version)`;
+        } else dispatchLine = "batch (one forge process per matcher group)";
+        if (slowGroups.length > 0) dispatchLine += `; per-hook for slow group${slowGroups.length > 1 ? "s" : ""}: ${slowGroups.join(", ")}`;
+        let latestLine;
+        if (config.checkLatest === false) {
+          latestLine = "not checked (checkLatest:false)";
+        } else {
+          const latest = await (config.fetchLatest ?? (() => fetchLatestVersion({ registry: config.registry })))();
+          // an injected or misbehaving source may hand back anything: only plain semver is shown
+          if (latest === undefined || !isPlainVersion(latest)) latestLine = "unknown (offline, or the registry did not answer)";
+          else if (compareVersions(pluginVersion, latest) === -1) {
+            latestLine = `${latest} — a newer plugin is published; an old install keeps working but misses fixes, so update it`;
+          } else latestLine = `${latest} (up to date)`;
+        }
         const probeLine = lastProbe === undefined
           ? "not run yet (no session start in this process)"
           : lastProbe.ok
@@ -337,7 +422,7 @@ function apply(ctx, config = {}) {
             : `FAILED — gates inactive (${lastProbe.error})`;
         return {
           kind: "success",
-          text: `# Forge quality gates\n\nforgeBin: ${opts.forgeBin} (${binSource})  timeoutMs: ${opts.timeoutMs}\nprobe: ${probeLine}\n\n## Wired groups\n${groups}\n\n## Verdict summary (last ${recentRuns.length} runs)\n  runs=${summary.runs}  blocked=${summary.blocked}  fail-open=${summary.failOpen}  contexts=${summary.contexts}\n\n## Recent runs (last 10)\n${runs}`,
+          text: `# Forge quality gates\n\nplugin: ${pluginVersion}  latest: ${latestLine}\nforgeBin: ${opts.forgeBin} (${binSource})  timeoutMs: ${opts.timeoutMs}\ndispatch: ${dispatchLine}\nprobe: ${probeLine}\n\n## Wired groups\n${groups}\n\n## Verdict summary (last ${recentRuns.length} runs)\n  runs=${summary.runs}  blocked=${summary.blocked}  fail-open=${summary.failOpen}  contexts=${summary.contexts}\n\n## Timing per interception point (last ${recentRuns.length} runs)\n${timing}\n\n## Recent runs (last 10)\n${runs}`,
         };
       },
     }), "forge: status command");

package/lib/latest.js

@@ -0,0 +1,90 @@
+/**
+ * @agent_forge/forge-dsh — "is a newer plugin published?" for /forge-status.
+ *
+ * Version drift between an installed plugin and the repo is silent: an old
+ * install keeps working while missing fixes (the audit found a 1.74.1 install
+ * lacking everything since). /forge-status is the one place the user looks when
+ * something seems off, so it asks the registry once, with a short timeout, and
+ * shows the answer. It is a read-only GET issued only when the user runs the
+ * command, never at session start, and every failure (offline, private registry,
+ * odd response) degrades to "unknown" — a status command must not throw.
+ *
+ * 已装插件与仓库的版本漂移是静默的：旧版一直能用，只是缺修复（审计里 1.74.1 的装机就缺了
+ * 此后的一切）。/forge-status 是用户觉得不对劲时唯一会看的地方，所以在这里问一次 registry
+ * （短超时）并展示结果。只在用户执行该命令时发一次只读 GET，绝不在会话启动时发；任何失败
+ * （离线、私有 registry、响应异常）都降级为「未知」——状态命令不能抛错。
+ *
+ * @module latest
+ */
+
+const DEFAULT_REGISTRY = "https://registry.npmjs.org";
+const PACKAGE_PATH = "@agent_forge%2Fforge-dsh";
+
+/** A published plugin version: plain semver, optionally with a pre-release/build tag, bounded length. */
+const PLAIN_VERSION = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]{1,40})?$/;
+
+/**
+ * Whether a string is safe to show as a version. The registry's answer ends up in
+ * /forge-status text, which the model can read, so anything that is not plain semver
+ * (newlines, escape sequences, prose) is refused rather than echoed.
+ *
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function isPlainVersion(value) {
+  return typeof value === "string" && value.length <= 64 && PLAIN_VERSION.test(value);
+}
+
+/**
+ * Compare the numeric core (major.minor.patch) of two versions. A pre-release
+ * suffix is ignored; an unparseable input has no order.
+ *
+ * @param {string|undefined} a
+ * @param {string|undefined} b
+ * @returns {-1|0|1|undefined} negative when a is older than b.
+ */
+export function compareVersions(a, b) {
+  const core = (v) => {
+    const m = /^(\d+)\.(\d+)\.(\d+)/.exec(String(v ?? ""));
+    return m === null ? undefined : [Number(m[1]), Number(m[2]), Number(m[3])];
+  };
+  const left = core(a);
+  const right = core(b);
+  if (left === undefined || right === undefined) return undefined;
+  for (let i = 0; i < 3; i += 1) {
+    if (left[i] !== right[i]) return left[i] < right[i] ? -1 : 1;
+  }
+  return 0;
+}
+
+/**
+ * The registry's latest published plugin version, or undefined on any failure.
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.registry="https://registry.npmjs.org"]
+ * @param {number} [opts.timeoutMs=3000]
+ * @param {typeof fetch} [opts.fetch] - injected for tests; defaults to the global fetch.
+ * @param {boolean} [opts.noGlobalFetch] - tests: pretend the runtime has no fetch.
+ * @returns {Promise<string|undefined>}
+ */
+export async function fetchLatestVersion(opts = {}) {
+  const doFetch = opts.fetch ?? (opts.noGlobalFetch ? undefined : globalThis.fetch);
+  if (typeof doFetch !== "function") return undefined;
+  const controller = new AbortController();
+  // Not unref'd: the timer is what ends a hung request, and `finally` clears it, so it can keep
+  // the process alive for at most timeoutMs. An unref'd timer lets the loop exit mid-request when
+  // nothing else is pending.
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 3000);
+  try {
+    // inside the try: a misconfigured registry value must not make /forge-status throw
+    const registry = String(opts.registry ?? DEFAULT_REGISTRY).replace(/\/+$/, "");
+    const res = await doFetch(`${registry}/${PACKAGE_PATH}/latest`, { signal: controller.signal });
+    if (!res?.ok) return undefined;
+    const body = await res.json();
+    return isPlainVersion(body?.version) ? body.version : undefined;
+  } catch {
+    return undefined;
+  } finally {
+    clearTimeout(timer);
+  }
+}

package/lib/messages.js

@@ -0,0 +1,110 @@
+/**
+ * @agent_forge/forge-dsh — model-facing message catalogue.
+ *
+ * Every line the plugin itself puts into the conversation lives here, in both
+ * languages, so the wording of one session is uniform (the old mix: English
+ * missing-CLI notice, Chinese welcome) and a new message cannot ship in one
+ * language only — a test pins that the two catalogues have the same keys.
+ * forge's own hook texts are not translated here; they come from the forge binary.
+ *
+ * Language: config `locale` > env FORGE_DSH_LOCALE > the system locale. A value that
+ * names no supported language is skipped; with nothing usable the result is English.
+ *
+ * 插件自己写进对话的每一句话都集中在此，中英各一份：同一会话措辞统一（此前缺 CLI 提示
+ * 是英文、欢迎语是中文），且新增消息不可能只有一种语言——测试钉住两份目录键集合相同。
+ * forge 自己 hook 的文案由 forge 二进制输出，不在此翻译。
+ * 语言：配置 locale > 环境变量 FORGE_DSH_LOCALE > 系统 locale；不支持的一律回落英文。
+ *
+ * @module messages
+ */
+
+/** Supported catalogue languages. */
+const LOCALES = new Set(["en", "zh"]);
+
+/**
+ * Pick the catalogue language.
+ *
+ * @param {string|undefined} configured - the profile patch's `locale` ("en" | "zh" | "auto").
+ * @param {Record<string, string|undefined>} [env] - process.env override (tests).
+ * @param {() => string} [systemLocale] - system locale tag source (tests).
+ * @returns {"en"|"zh"}
+ */
+export function resolveLocale(
+  configured,
+  env = process.env,
+  systemLocale = () => Intl.DateTimeFormat().resolvedOptions().locale,
+) {
+  // Tags are normalized (zh-CN, zh_CN, ZH, zh-Hans all mean zh). A value that names no supported
+  // language — a typo, "auto", a language we have no catalogue for — does not decide anything and
+  // falls through to the next source, so a bad config line cannot mask FORGE_DSH_LOCALE or the system.
+  for (const candidate of [configured, env.FORGE_DSH_LOCALE]) {
+    const language = String(candidate ?? "").trim().toLowerCase().replace(/_/g, "-").split("-")[0];
+    if (LOCALES.has(language)) return language;
+  }
+  try {
+    return systemLocale().toLowerCase().startsWith("zh") ? "zh" : "en";
+  } catch {
+    return "en";
+  }
+}
+
+const quoted = (path) => (/\s/.test(path) ? `"${path}"` : path);
+
+const en = {
+  /** One first-turn line; the user only sees what the model relays, hence the explicit ask. */
+  welcome: (pluginVersion, forgeVersion) =>
+    `[forge-dsh] Forge quality gates now govern this project (plugin ${pluginVersion}${forgeVersion === undefined ? "" : `, forge ${forgeVersion}`}): ` +
+    "create a forge task before editing source, and dangerous Bash commands are intercepted. " +
+    "In your first reply, tell the user this in one sentence and mention /forge-status for status and `forge off` to switch the gates off. Say it only once.",
+  /** The bundled binary is not on PATH while forge's gate messages say `forge task …`. */
+  bundledHint: (binPath) =>
+    `[forge-dsh] forge CLI bundled with this plugin: ${quoted(binPath)}. It may not be on PATH — ` +
+    "when a gate message or the protocol tells you to run a `forge …` command, " +
+    "run it with this path instead of `forge`.",
+  /** Installing writes the user's home (~/.agents/skills), hence "after the user agrees". */
+  skillsHint: (forgeBin) =>
+    "[forge-dsh] Forge's skill library is not installed for DSH (~/.agents/skills is empty), so the skills forge hooks point to are unavailable. " +
+    "Offer to install it, and run `" + quoted(forgeBin) + " skills install --global --target agents` only after the user agrees.",
+  missingForge: (forgeBin, error) =>
+    `[forge-dsh] forge CLI not found (forgeBin: ${forgeBin}). ` +
+    "Forge gates are OFF for this session — every action runs unguarded (fail-open). " +
+    "Reinstall the plugin (it bundles forge) or run `npm install -g @agent_forge/forge`, then start a new session; " +
+    "if it lives elsewhere, set forgeBin in the profile patch." +
+    (error === undefined ? "" : `\nProbe error: ${error}`),
+  degraded: (count) =>
+    `[forge-dsh] ${count} forge hook runs failed open in this session (a timeout or an unreadable forge reply), so those checks did not run. ` +
+    "Run /forge-status to see which, and raise timeoutMs if a gate is timing out. This is advisory; nothing is blocked.",
+};
+
+const zh = {
+  welcome: (pluginVersion, forgeVersion) =>
+    `[forge-dsh] Forge 质量门禁已接管本项目（插件 ${pluginVersion}${forgeVersion === undefined ? "" : `，forge ${forgeVersion}`}）：修改源码前需先建 forge task，危险的 Bash 命令会被拦截。` +
+    "请在本会话第一次回复的末尾用一句话告知用户这一点，并提示：/forge-status 查看状态，forge off 关闭门禁。只提这一次。",
+  bundledHint: (binPath) =>
+    `[forge-dsh] 本插件自带的 forge CLI：${quoted(binPath)}。它可能不在 PATH 上——` +
+    "当门禁消息或协议要求你运行 `forge …` 命令时，请用这个路径代替 `forge`。",
+  skillsHint: (forgeBin) =>
+    "[forge-dsh] 尚未为 DSH 安装 Forge 技能库（~/.agents/skills 为空），forge hook 提示的 skill 因此不可用。" +
+    "请向用户提议安装，征得用户同意后再运行 `" + quoted(forgeBin) + " skills install --global --target agents`。",
+  missingForge: (forgeBin, error) =>
+    `[forge-dsh] 未找到 forge CLI（forgeBin：${forgeBin}）。` +
+    "本会话 Forge 门禁处于关闭状态——所有操作都不受保护（fail-open）。" +
+    "请重装本插件（它自带 forge）或运行 `npm install -g @agent_forge/forge`，然后开启新会话；" +
+    "如果 forge 在别处，请在 profile patch 里设置 forgeBin。" +
+    (error === undefined ? "" : `\n探测错误：${error}`),
+  degraded: (count) =>
+    `[forge-dsh] 本会话有 ${count} 次 forge hook 运行 fail-open（超时或 forge 回复无法解析），这些检查没有执行。` +
+    "运行 /forge-status 查看是哪些，若某个门禁超时请调大 timeoutMs。这只是提示，不会阻断任何操作。",
+};
+
+const CATALOGUES = { en, zh };
+
+/**
+ * The message catalogue for a language; unknown languages get English.
+ *
+ * @param {string} locale
+ * @returns {typeof en}
+ */
+export function messagesFor(locale) {
+  return CATALOGUES[locale] ?? en;
+}

package/lib/runner.js

@@ -27,6 +27,7 @@ import { spawn } from "node:child_process";
  * @property {string} [reason]  - block reason (shown to the model).
  * @property {string} [context] - allow-path additionalContext to inject.
  * @property {string} [error]   - infrastructure failure note (fail-open path).
+ * @property {boolean} [timedOut] - the failure was the ceiling kill (not a forge error).
  */
 
 /**
@@ -39,7 +40,8 @@ import { spawn } from "node:child_process";
  * and EVERY gate silently fails open. cmd.exe resolves forge.cmd via PATHEXT
  * (and a bare forge.exe directly), so win32 routes through it. argv holds
  * spec constants only (safe charset). The binary is operator config and is
- * quoted, never escaped — see the metacharacter note inside planSpawn.
+ * quoted, never escaped — see the metacharacter note inside planSpawn. Arguments
+ * with a cmd metacharacter (a batch matcher such as Write|Edit) are quoted too.
  *
  * @param {string} forgeBin - binary name/path from config.
  * @param {string[]} argv - hook arguments (spec constants).
@@ -56,9 +58,11 @@ export function planSpawn(forgeBin, argv, platform = process.platform) {
   // %VAR% expansion (cmd expands it even inside quotes) and ! with delayed
   // expansion (off by default). Both are accepted residual risk because
   // forgeBin is trusted operator config — the same trust level as PATH itself.
-  const needsQuotes = /[&|()<>^,;=\s]/.test(forgeBin);
-  const file = needsQuotes && !forgeBin.includes('"') ? `"${forgeBin}"` : forgeBin;
-  return { file, args: argv, shell: true };
+  const quote = (token) => (/[&|()<>^,;=\s]/.test(token) && !token.includes('"') ? `"${token}"` : token);
+  // Arguments get the same treatment: a batch matcher like "Write|Edit" would
+  // otherwise be parsed by cmd.exe as a pipe. Spec-constant arguments (hook
+  // names, flags) carry no metacharacter and pass through unchanged.
+  return { file: quote(forgeBin), args: argv.map(quote), shell: true };
 }
 
 /**
@@ -73,10 +77,37 @@ export function planSpawn(forgeBin, argv, platform = process.platform) {
  * @returns {Promise<HookVerdict>}
  */
 export function runForgeHook(command, payload, opts = {}) {
+  const parts = command.split(" "); // ["forge","hook","task-guard"]
+  return runForge(parts.slice(1), payload, opts);
+}
+
+/**
+ * Run one whole matcher group in a single forge process:
+ * `forge hook batch --event <E> [--matcher <M>]`. forge runs the group's roster
+ * in order, stops at the first block, and prints that hook's decision JSON to
+ * stdout (same contract as a single hook); allow-path contexts come back merged
+ * into one document. One spawn instead of N saves the per-process start-up cost on
+ * every tool call. Forges from before the stdout fix print nothing on a block —
+ * decisions.runMatchedGroups detects that and falls back to per-hook runs.
+ *
+ * @param {string} event - forge event name (PreToolUse, Stop, …).
+ * @param {string} matcher - the spec group's matcher; "" selects the event's
+ *   matcher-less group.
+ * @param {object} payload - Claude-Code-shape hook stdin payload.
+ * @param {object} [opts] - same as runForgeHook.
+ * @returns {Promise<HookVerdict>}
+ */
+export function runForgeBatch(event, matcher, payload, opts = {}) {
+  const argv = ["hook", "batch", "--event", event];
+  if (matcher !== "") argv.push("--matcher", matcher);
+  return runForge(argv, payload, opts);
+}
+
+/** Spawn forge with `argv`, feed the payload, and fold stdout into a verdict. */
+function runForge(argv, payload, opts) {
   const forgeBin = opts.forgeBin ?? "forge";
   const timeoutMs = opts.timeoutMs ?? 30000;
-  const parts = command.split(" "); // ["forge","hook","task-guard"]
-  const plan = planSpawn(forgeBin, parts.slice(1));
+  const plan = planSpawn(forgeBin, argv);
   return new Promise((resolve) => {
     let child;
     try {
@@ -109,7 +140,7 @@ export function runForgeHook(command, payload, opts = {}) {
       if (settled) return;
       settled = true;
       killTree(child, plan.shell);
-      resolve({ block: false, error: `timeout after ${timeoutMs}ms` });
+      resolve({ block: false, error: `timeout after ${timeoutMs}ms`, timedOut: true });
     }, timeoutMs);
     const settle = (verdict) => {
       if (settled) return;

package/lib/skills.js

@@ -0,0 +1,38 @@
+/**
+ * @agent_forge/forge-dsh — is Forge's skill library installed for DSH?
+ *
+ * Installing the plugin delivers the bridge and (via its dependency) the forge
+ * CLI, but not the skill library: DSH reads the agent-neutral `~/.agents/skills`
+ * directory, which only `forge skills install --global --target agents` fills.
+ * Without it a DSH user silently gets half the product, so the first-turn
+ * onboarding offers the install when the directory is empty.
+ *
+ * 装插件交付的是桥接层和（经依赖）forge CLI，不含技能库：DSH 读跨 agent 的
+ * `~/.agents/skills`，只有 `forge skills install --global --target agents` 会填充它。
+ * 缺了它 DSH 用户悄悄只拿到半个产品，所以目录为空时首轮引导会提议安装。
+ *
+ * @module skills
+ */
+import { readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+/**
+ * Whether `<home>/.agents/skills` holds at least one entry (a link or a copy).
+ * A missing directory counts as not installed. Any other failure — an unreadable
+ * or odd location — degrades to `true`: this only gates a polite nudge, and
+ * nagging on an error the plugin cannot interpret would be worse than staying quiet.
+ *
+ * @param {string} [home] - home directory (tests); defaults to the user's.
+ * @param {(dir: string) => string[]} [readdir] - directory reader (tests); defaults to fs.readdirSync.
+ * @returns {boolean}
+ */
+export function agentsSkillsInstalled(home = homedir(), readdir = readdirSync) {
+  if (typeof home !== "string" || home === "") return true;
+  try {
+    // dotfiles (.DS_Store …) are not skills
+    return readdir(join(home, ".agents", "skills")).some((name) => !name.startsWith("."));
+  } catch (error) {
+    return error?.code !== "ENOENT";
+  }
+}

package/lib/tools.js

@@ -89,6 +89,27 @@ export function matchedCommands(groups, ccName) {
   return commands;
 }
 
+/**
+ * The spec groups of one event whose matcher accepts ccName, as
+ * `{matcher, commands}` in spec order. The matcher is what `forge hook batch
+ * --matcher` selects on ("" = the event's matcher-less group); `commands` is the
+ * same group's roster, kept for the serial fallback. Matching semantics are
+ * identical to matchedCommands.
+ *
+ * @param {Array<{matcher?: string, hooks: Array<{command: string}>}>} groups
+ * @param {string} ccName
+ * @returns {Array<{matcher: string, commands: string[]}>}
+ */
+export function matchedGroups(groups, ccName) {
+  const out = [];
+  for (const group of groups ?? []) {
+    const matcher = group.matcher ?? "";
+    if (matcher !== "" && !new RegExp(`^(?:${matcher})$`).test(ccName)) continue;
+    out.push({ matcher, commands: (group.hooks ?? []).map((hook) => hook.command) });
+  }
+  return out;
+}
+
 /**
  * Extract the session identity forge expects from a DSH agent handle.
  * Falls back to process cwd and an empty session id (forge degrades to its
@@ -221,23 +242,3 @@ export function isSubagent(agent) {
   const header = agent?.session?.header;
   return header?.origin === "subagent" || header?.parentSession !== undefined;
 }
-
-/**
- * First-turn onboarding line (model-facing; the user only sees what the model
- * relays, so it asks for one sentence in the first reply). Carries the plugin
- * and forge versions so a stale install is visible at a glance.
- *
- * 首轮引导：模型可见、用户只能通过模型复述看到，所以明确要求在第一次回复里
- * 用一句话告知用户；带插件与 forge 版本，装旧版一眼可见。
- *
- * @param {string} pluginVersion
- * @param {string|undefined} forgeVersion
- * @returns {string}
- */
-export function welcomeText(pluginVersion, forgeVersion) {
-  const versions = `插件 ${pluginVersion}${forgeVersion === undefined ? "" : `，forge ${forgeVersion}`}`;
-  return (
-    `[forge-dsh] Forge 质量门禁已接管本项目（${versions}）：修改源码前需先建 forge task，危险的 Bash 命令会被拦截。` +
-    "请在本会话第一次回复的末尾用一句话告知用户这一点，并提示：/forge-status 查看状态，forge off 关闭门禁。只提这一次。"
-  );
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent_forge/forge-dsh",
-  "version": "1.82.0",
+  "version": "1.83.0",
   "description": "Forge quality gates for DeepSeek Harness (dsh): task gates, read-before-edit, bash hazard interception and quality scoring, driven by the forge CLI through DSH's typed interception points.",
   "repository": {
     "type": "git",
@@ -14,6 +14,9 @@
     "lib/index.js",
     "lib/runner.js",
     "lib/bundled.js",
+    "lib/messages.js",
+    "lib/skills.js",
+    "lib/latest.js",
     "lib/decisions.js",
     "lib/tools.js",
     "lib/spec.json",
@@ -37,7 +40,7 @@
   ],
   "license": "Apache-2.0",
   "dependencies": {
-    "@agent_forge/forge": "1.82.0"
+    "@agent_forge/forge": "1.83.0"
   },
   "engines": {
     "node": ">=18"