@andyqiu/codeforge 0.5.12 → 0.5.14

package/bin/codeforge.mjs

@@ -95,7 +95,7 @@ function parseArgs(argv) {
 // ────────────────────────────────────────────────────────────────────
 // opencode installer：薄壳，调现成的 install.ps1 / install.sh
 // ────────────────────────────────────────────────────────────────────
-function installOpencode({ scope, dryRun, extraArgs }) {
+function installOpencode({ scope, dryRun, extraArgs, quiet = false }) {
   const isWin = process.platform === "win32"
   const script = isWin ? path.join(REPO_ROOT, "install.ps1") : path.join(REPO_ROOT, "install.sh")
   if (!existsSync(script)) {
@@ -116,7 +116,11 @@ function installOpencode({ scope, dryRun, extraArgs }) {
   }
   const all = [...baseArgs, ...flagArgs, ...(extraArgs ?? [])]
   log(`opencode: ${cmd} ${all.join(" ")}`)
-  const r = spawnSync(cmd, all, { stdio: "inherit", cwd: REPO_ROOT })
+  const r = spawnSync(cmd, all, { stdio: quiet ? "pipe" : "inherit", cwd: REPO_ROOT })
+  if (quiet && r.status !== 0) {
+    if (r.stderr) process.stderr.write(r.stderr)
+    if (r.stdout) process.stderr.write(r.stdout)
+  }
   return r.status ?? 1
 }
 
@@ -288,46 +292,86 @@ function cmdRollback(args) {
 // ────────────────────────────────────────────────────────────────────
 // 子命令：upgrade —— 升级到 npm latest 并重新 install --global
 // ────────────────────────────────────────────────────────────────────
-function cmdUpgrade(args) {
+
+async function cmdUpgrade(args) {
   const dryRun = !!args.flags["dry-run"] || !!args.flags.dryRun
   const currentVersion = getVersion()
 
-  log(`CodeForge upgrade`)
-  log(`  当前版本 : ${currentVersion}`)
-  log(`  dry-run  : ${dryRun}`)
-  hr()
+  log(`检查版本...`)
 
-  const npmCmd = "npm"
-  const npmArgs = ["install", "-g", "@andyqiu/codeforge@latest"]
-  log(`步骤 1/2：${npmCmd} ${npmArgs.join(" ")}`)
-
-  if (!dryRun) {
-    const r = spawnSync(npmCmd, npmArgs, { stdio: "inherit", shell: true })
-    if (r.status !== 0) {
-      err(`npm install 失败 (exit=${r.status ?? 1})`)
-      err(`提示：可手动跑 npm install -g @andyqiu/codeforge@latest`)
-      return 1
-    }
+  // 查询 npm registry 最新版本
+  let latestVersion = null
+  try {
+    latestVersion = await new Promise((resolve) => {
+      import("node:https").then((mod) => {
+        const https = mod.default ?? mod  // node:https ESM 无 default export
+        const options = {
+          hostname: "registry.npmjs.org",
+          path: "/@andyqiu%2Fcodeforge/latest",
+          method: "GET",
+          headers: { "User-Agent": "codeforge-cli" },
+          timeout: 5000,
+        }
+        const req = https.get(options, (res) => {
+          let data = ""
+          res.on("data", (chunk) => { data += chunk })
+          res.on("end", () => {
+            try { resolve(JSON.parse(data).version ?? null) } catch { resolve(null) }
+          })
+        })
+        req.on("timeout", () => { req.destroy(); resolve(null) })
+        req.on("error", () => resolve(null))
+      }).catch(() => resolve(null))
+    })
+  } catch {
+    latestVersion = null
+  }
+
+  if (latestVersion === null) {
+    warn(`版本检查失败，继续升级流程`)
+  } else if (latestVersion === currentVersion) {
+    ok(`当前已是最新版本 v${currentVersion}，无需升级`)
+    return 0
   } else {
-    log(`[dry-run] 跳过 npm install`)
+    log(`当前版本：${currentVersion} → 最新版本：${latestVersion}`)
   }
 
   hr()
-  log(`步骤 2/2：codeforge install --global`)
+  log(`正在升级...`)
 
-  if (!dryRun) {
-    const skipBuildFlag = process.platform === "win32" ? "-SkipBuild" : "--skip-build"
-    const code = installOpencode({ scope: "global", dryRun: false, extraArgs: [skipBuildFlag] })
-    if (code !== 0) {
-      err(`install --global 失败 (exit=${code})`)
-      return 1
-    }
-  } else {
-    log(`[dry-run] 跳过 install --global`)
+  const npmCmd = "npm"
+  // 有明确版本号时用精确版本，绕过 @latest dist-tag 缓存
+  const installTarget = latestVersion
+    ? `@andyqiu/codeforge@${latestVersion}`
+    : "@andyqiu/codeforge@latest"
+  const npmArgs = ["install", "-g", installTarget]
+
+  if (dryRun) {
+    const displayNew = latestVersion ?? "未知（版本查询失败）"
+    ok(`[dry-run] 演示升级：${currentVersion} → ${displayNew}`)
+    ok(`[dry-run] 实际执行时将自动重启生效提示`)
+    return 0
   }
 
-  hr()
-  ok(`升级完成！运行 codeforge -v 查看新版本`)
+  const r = spawnSync(npmCmd, npmArgs, { stdio: "pipe", shell: true })
+  if (r.status !== 0) {
+    if (r.stderr) process.stderr.write(r.stderr)
+    if (r.stdout) process.stderr.write(r.stdout)
+    err(`npm install 失败 (exit=${r.status ?? 1})`)
+    err(`提示：可手动跑 npm install -g ${installTarget}`)
+    return 1
+  }
+
+  const skipBuildFlag = process.platform === "win32" ? "-SkipBuild" : "--skip-build"
+  const code = installOpencode({ scope: "global", dryRun: false, extraArgs: [skipBuildFlag], quiet: true })
+  if (code !== 0) {
+    err(`install --global 失败 (exit=${code})`)
+    return 1
+  }
+
+  // 升级后读取新版本（npm install 成功后本地 package.json 已更新）
+  const newVersion = latestVersion ?? getVersion()
+  ok(`升级完成：${currentVersion} → ${newVersion}`)
   ok(`重启 opencode 后新版本生效`)
   return 0
 }
@@ -437,7 +481,7 @@ function cmdHelp() {
   codeforge list
   codeforge version
   codeforge rollback   [--target=<path>] [--dry-run]   # 恢复最近 backup（auto_install 失败救场）
-  codeforge upgrade           [--dry-run]   # 升级到 npm latest 并重新 install --global
+  codeforge upgrade|update    [--dry-run]   # 升级到 npm latest 并重新 install --global
   codeforge runtime where [<path>]   # 打印当前项目的全局运行时目录
   codeforge adr-init   [--force] [--dry-run] [--write-prepare] [--no-pre-push]
                                      # 把 ADR 校验体系（hooks + scripts + 模板）下发到当前 git 项目
@@ -502,6 +546,7 @@ async function main() {
     case "rollback":
       return cmdRollback(args)
     case "upgrade":
+    case "update":
       return cmdUpgrade(args)
     case "runtime":
       return cmdRuntime(args)

package/dist/index.js

@@ -21355,23 +21355,27 @@ var RISK_PATTERNS = [
   },
   {
     tag: "write_secrets",
+    kinds: ["bash"],
     re: /(\.env(?:\.\w+)?|id_[edr]sa|\.ssh\/id_|\.pem|\.p12|secret\.json)/i,
-    matchOn: ["command", "filePath", "path"]
+    matchOn: ["command"]
   },
   {
     tag: "write_etc",
     kinds: ["bash", "edit"],
-    re: /(?:^|\s|"|')\/etc\//
+    re: /(?:^|\s|"|')\/etc\//,
+    matchOn: ["command", "filePath", "path"]
   },
   {
     tag: "write_usr",
     kinds: ["bash", "edit"],
-    re: /(?:^|\s|"|')\/usr\//
+    re: /(?:^|\s|"|')\/usr\//,
+    matchOn: ["command", "filePath", "path"]
   },
   {
     tag: "write_root_home",
     kinds: ["bash", "edit"],
-    re: /(?:^|\s|"|')(\/root|\/home\/root)\//
+    re: /(?:^|\s|"|')(\/root|\/home\/root)\//,
+    matchOn: ["command", "filePath", "path"]
   },
   {
     tag: "internal_url",
@@ -21774,7 +21778,7 @@ import * as zlib from "node:zlib";
 // lib/version-injected.ts
 function getInjectedVersion() {
   try {
-    const v = "0.5.12";
+    const v = "0.5.14";
     if (typeof v === "string" && /^\d+\.\d+\.\d+/.test(v)) {
       return v;
     }
@@ -23082,8 +23086,22 @@ var _touchCache = new Map;
 var CLASS_B_CALLER_WHITELIST = new Set([
   "codeforge",
   "reviewer",
+  "reviewer-lite",
   "general"
 ]);
+var CODEFORGE_WORKTREE_DIR_NAME = path27.join(".git", "codeforge-worktrees");
+function worktreesRoot(mainRoot) {
+  return path27.join(mainRoot, CODEFORGE_WORKTREE_DIR_NAME);
+}
+function isInsideAnyWorktreeDir(absPath, mainRoot) {
+  if (!path27.isAbsolute(absPath))
+    return false;
+  const root = worktreesRoot(mainRoot);
+  if (absPath === root)
+    return false;
+  const prefix = root.endsWith(path27.sep) ? root : root + path27.sep;
+  return absPath.startsWith(prefix);
+}
 function rewritePath(value, mainRoot, worktreeRoot) {
   if (!value)
     return null;
@@ -23092,6 +23110,9 @@ function rewritePath(value, mainRoot, worktreeRoot) {
   if (resolved === worktreeRoot || resolved.startsWith(wtPrefix2)) {
     return null;
   }
+  if (isInsideAnyWorktreeDir(resolved, mainRoot)) {
+    return null;
+  }
   if (resolved === mainRoot)
     return worktreeRoot;
   const prefix = mainRoot.endsWith("/") ? mainRoot : mainRoot + "/";
@@ -23121,7 +23142,20 @@ function commandContainsMainRootExcludingWorktree(command, mainRoot, worktreePat
       return true;
     }
   }
-  const sanitized = command.split(worktreePath).join("");
+  const wtRoot = worktreesRoot(mainRoot);
+  const wtRootPrefix = wtRoot + path27.sep;
+  const escapedWtRootPrefix = escapeRegex2(wtRootPrefix);
+  const wtPathPattern = escapedWtRootPrefix + `[^\\s'"\\x60)]*`;
+  const allWorktreePathsReForEscape = new RegExp(wtPathPattern, "g");
+  const allWorktreePathsReForReplace = new RegExp(wtPathPattern, "g");
+  for (const match of command.matchAll(allWorktreePathsReForEscape)) {
+    const matchedPath = match[0];
+    const tail = matchedPath.slice(wtRootPrefix.length);
+    if (/(?:^|[/\\])\.\.(?:[/\\]|$)/.test(tail)) {
+      return true;
+    }
+  }
+  const sanitized = command.split(worktreePath).join("").replace(allWorktreePathsReForReplace, "");
   return commandContainsMainRoot(sanitized, mainRoot);
 }
 function detectBashWriteIntent(command, mainRoot) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andyqiu/codeforge",
-  "version": "0.5.12",
+  "version": "0.5.14",
   "description": "CodeForge — opencode 的零侵入扩展包",
   "type": "module",
   "private": false,

package/scripts/sync-agent-models.mjs

@@ -25,6 +25,7 @@
 import { promises as fs } from "node:fs"
 import * as path from "node:path"
 import * as url from "node:url"
+import { syncToGlobalOpencode } from "./dev-sync.mjs"
 
 const args = new Set(process.argv.slice(2))
 const CHECK = args.has("--check")
@@ -99,6 +100,13 @@ async function main() {
       process.exit(1)
     }
   }
+
+  // 写盘完成后，把更新后的 agents/*.md 同步到 ~/.config/opencode/agents/
+  // 仅在非 DRY/CHECK 模式且有 .codeforge/.dev-marker 时生效（dev-sync.mjs 内部检查 marker）
+  if (!DRY && summary.changed.length > 0) {
+    console.log("[sync-models] 同步已更新 agents/*.md -> 全局 opencode (ADR:dev-sync-to-global)")
+    await syncToGlobalOpencode({ projectRoot: ROOT, dryRun: false })
+  }
 }
 
 /**