@andyqiu/codeforge 0.6.12 → 0.7.0

package/dist/index.js

@@ -34,15 +34,15 @@ __export(exports_worktree_ops, {
   commitWorktreeIfDirty: () => commitWorktreeIfDirty
 });
 import { execFile as execFile2 } from "node:child_process";
-import { promises as fs8 } from "node:fs";
-import * as path11 from "node:path";
+import { promises as fs7 } from "node:fs";
+import * as path9 from "node:path";
 async function ensureWorktree(opts) {
-  const root = path11.resolve(opts.root);
-  const dir = opts.worktrees_dir ?? path11.join(root, ".git", "codeforge-worktrees");
-  await fs8.mkdir(dir, { recursive: true });
-  const wtPath = path11.join(dir, sanitizeBranch(opts.branch));
+  const root = path9.resolve(opts.root);
+  const dir = opts.worktrees_dir ?? path9.join(root, ".git", "codeforge-worktrees");
+  await fs7.mkdir(dir, { recursive: true });
+  const wtPath = path9.join(dir, sanitizeBranch(opts.branch));
   try {
-    const stat = await fs8.stat(wtPath);
+    const stat = await fs7.stat(wtPath);
     if (stat.isDirectory()) {
       return { path: wtPath, branch: opts.branch, created: false };
     }
@@ -76,7 +76,7 @@ function isWorktreeAbsentError(err) {
   return /is not a working tree/i.test(msg) || /No such file or directory/i.test(msg) || /not a valid path/i.test(msg);
 }
 async function deleteBranchIfExists(opts) {
-  const root = path11.resolve(opts.root);
+  const root = path9.resolve(opts.root);
   const timeout = opts.git_timeout_ms ?? 5000;
   try {
     await runGit(root, ["rev-parse", "--verify", `refs/heads/${opts.branch}`], 3000);
@@ -133,7 +133,7 @@ function sanitizeBranch(name) {
   return name.replace(/[/\\:*?"<>|]/g, "-");
 }
 function runGitAllowFail(cwd, args, timeout) {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve9, reject) => {
     execFile2("git", args, { cwd, timeout, windowsHide: true, encoding: "utf8" }, (err, stdout, stderr) => {
       if (err) {
         const errCode = err.code;
@@ -141,30 +141,30 @@ function runGitAllowFail(cwd, args, timeout) {
           reject(new Error(`git ${args.join(" ")} 失败: ${stderr || err.message}`));
           return;
         }
-        resolve10({
+        resolve9({
           code: typeof errCode === "number" ? errCode : 1,
           stdout: stdout ?? "",
           stderr: stderr ?? err.message ?? ""
         });
         return;
       }
-      resolve10({ code: 0, stdout, stderr: stderr ?? "" });
+      resolve9({ code: 0, stdout, stderr: stderr ?? "" });
     });
   });
 }
 function runGit(cwd, args, timeout) {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve9, reject) => {
     execFile2("git", args, { cwd, timeout, windowsHide: true, encoding: "utf8" }, (err, stdout, stderr) => {
       if (err) {
         reject(new Error(`git ${args.join(" ")} 失败: ${stderr || err.message}`));
         return;
       }
-      resolve10(stdout);
+      resolve9(stdout);
     });
   });
 }
 async function tryMerge(opts) {
-  const root = path11.resolve(opts.root);
+  const root = path9.resolve(opts.root);
   const timeout = opts.git_timeout_ms ?? 1e4;
   const status = await runGitAllowFail(root, ["status", "--porcelain"], 3000);
   if (status.code !== 0) {
@@ -210,27 +210,27 @@ async function tryMerge(opts) {
   };
 }
 async function mergeCommit(opts) {
-  const root = path11.resolve(opts.root);
+  const root = path9.resolve(opts.root);
   await runGit(root, ["commit", "-m", opts.message], opts.git_timeout_ms ?? 1e4);
 }
 async function mergeAbort(opts) {
-  const root = path11.resolve(opts.root);
+  const root = path9.resolve(opts.root);
   await runGitAllowFail(root, ["merge", "--abort"], opts.git_timeout_ms ?? 5000);
 }
 async function getMergeConflicts(opts) {
-  const out = await runGitAllowFail(path11.resolve(opts.root), ["diff", "--name-only", "--diff-filter=U"], opts.git_timeout_ms ?? 3000);
+  const out = await runGitAllowFail(path9.resolve(opts.root), ["diff", "--name-only", "--diff-filter=U"], opts.git_timeout_ms ?? 3000);
   if (out.code !== 0)
     return [];
   return out.stdout.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
 }
 async function worktreeHasChanges(opts) {
-  const out = await runGitAllowFail(path11.resolve(opts.worktree_path), ["status", "--porcelain"], opts.git_timeout_ms ?? 3000);
+  const out = await runGitAllowFail(path9.resolve(opts.worktree_path), ["status", "--porcelain"], opts.git_timeout_ms ?? 3000);
   if (out.code !== 0)
     return false;
   return out.stdout.trim().length > 0;
 }
 async function commitWorktreeIfDirty(opts) {
-  const wt = path11.resolve(opts.worktree_path);
+  const wt = path9.resolve(opts.worktree_path);
   const timeout = opts.git_timeout_ms ?? 1e4;
   const status = await runGitAllowFail(wt, ["status", "--porcelain"], 3000);
   if (status.code !== 0) {
@@ -10661,1732 +10661,1755 @@ class ApprovalStore {
   }
 }
 
-// tools/review-approval.ts
-var description4 = [
-  "reviewer 专用：写入 APPROVE 审批记录。",
-  "**何时调用**：reviewer 给出 `## Decision\\nAPPROVE` 之前必须调本工具。",
-  "**两层语义独立**（ADR:decision-token-vs-approval-verdict-layering）：",
-  "  - 本工具 `verdict` 字段属审批层，合法值：APPROVE / APPROVE_WITH_NOTES",
-  "  - reviewer 输出的 `## Decision` 节首行属协议层，合法值：APPROVE / REQUEST_CHANGES / BLOCK",
-  "  - ⚠️ 严禁把 `APPROVE_WITH_NOTES` 字面量写进 `## Decision` 节首行（容错层会归一，但其他变体如 APPROVE_MINOR 会失败 → merge-loop 误判死循环）",
-  '  - ✅ 正确：verdict="APPROVE_WITH_NOTES" + `## Decision\\nAPPROVE`（首行写 APPROVE，详情在审批 notes）',
-  "**pendingIds 格式**：推荐 `session:<sid>` / `plan:<plan_id>` / `decision:<hash>`；旧 `pc-<ts>-NNN` 仍兼容。",
-  "**何时不调**：REQUEST_CHANGES / BLOCK 不调（无 APPROVE = 无审批记录）。",
-  "**fallback**：codeforge 解析 reviewer boomerang 见 APPROVE 但无记录 → 自动以 source='codeforge-fallback' 补写。"
-].join(`
-`);
-var ArgsSchema4 = z4.object({
-  verdict: z4.enum(["APPROVE", "APPROVE_WITH_NOTES"]).describe("审批层裁决（审计字段，与协议层独立）；REQUEST_CHANGES / BLOCK 不应调本工具。⚠️ 不要把本字段值复制到 reviewer 输出的 `## Decision` 节首行 — 那是协议层 3 档。"),
-  pendingIds: z4.array(z4.string().min(1)).min(1, "pendingIds 至少 1 条").describe("本次 APPROVE 覆盖的 id 列表。推荐 session:<sid> / plan:<plan_id> / decision:<hash>；旧 pc-xxx 兼容"),
-  notes: z4.string().min(1, "notes 不能为空").max(2000, "notes 过长（> 2000 字），建议拆条").describe("审阅意见摘要（建议 ≤ 500 字）"),
-  decisionLine: z4.string().optional().describe("`## Decision` 节首行原文（默认 verdict 字面量，机审证据）"),
-  source: z4.enum(["reviewer", "codeforge-fallback"]).optional().describe("写入来源；默认 'reviewer'，codeforge 补写时传 'codeforge-fallback'"),
-  reviewerAgent: z4.string().optional().describe("写入 agent name（默认 'reviewer'；fallback 时为 'codeforge'）"),
-  sessionId: z4.string().optional().describe("reviewer 子 session id（boomerang 溯源用，可选）"),
-  model: z4.string().optional().describe("审批模型 id（审计用，可选）"),
-  coveredSha: z4.string().optional().describe("approval 写入时 worktree HEAD sha；reviewer 调此工具时传入（git -C <worktreePath> rev-parse HEAD）。pre-check 强绑定核心字段，缺失则 pre-check 不命中。ADR:merge-approval-pre-check"),
-  reviewTarget: z4.string().optional().describe("本次审阅的 review_target 值（reviewer.md 词表：code / code:typescript / code:python / code:csharp-lua-c / plan_only / adr / docs / decision_only）。pre-check 仅放行 startsWith('code') 的值；缺失或其他值均不命中。ADR:merge-approval-pre-check")
-});
-var _approvalStore = null;
-function getApprovalStore() {
-  if (!_approvalStore)
-    _approvalStore = ApprovalStore.forProject(process.cwd());
-  return _approvalStore;
-}
-async function execute4(input) {
-  const parsed = ArgsSchema4.safeParse(input);
-  if (!parsed.success) {
-    return {
-      ok: false,
-      error: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")
-    };
-  }
-  const args = parsed.data;
-  const approvals = getApprovalStore();
-  const now = new Date().toISOString();
-  const written = [];
-  for (const id of args.pendingIds) {
-    const meta = {
-      pendingId: id,
-      verdict: args.verdict,
-      reviewer: {
-        agent: args.reviewerAgent ?? (args.source === "codeforge-fallback" ? "codeforge" : "reviewer"),
-        ...args.sessionId ? { sessionId: args.sessionId } : {},
-        ...args.model ? { model: args.model } : {},
-        source: args.source ?? "reviewer"
-      },
-      targets: [],
-      decisionLine: args.decisionLine ?? args.verdict,
-      notes: args.notes,
-      createdAt: now,
-      ...args.coveredSha ? { coveredSha: args.coveredSha } : {},
-      ...args.reviewTarget ? { reviewTarget: args.reviewTarget } : {},
-      escapeHatch: null
-    };
-    const file = await approvals.record(meta);
-    written.push({ pendingId: id, file });
-  }
-  return { ok: true, written };
-}
-// tools/browser-navigate.ts
-import { z as z5 } from "zod";
+// lib/session-worktree.ts
+init_worktree_ops();
+import { execFile as execFile3 } from "node:child_process";
+import { promises as fs9 } from "node:fs";
+import * as path11 from "node:path";
 
-// lib/browser-control.ts
-import * as path9 from "node:path";
-var DEFAULT_CONFIG2 = {
-  enabled: false,
-  headless: true,
-  allow: ["^https?://"],
-  block: ["^file:", "^data:", "^about:", "^javascript:"],
-  actionTimeoutMs: 15000,
-  idleTimeoutMs: 5 * 60000,
-  screenshotDir: "",
-  bufferLimit: 500
-};
-function defaultScreenshotDir(root = process.cwd()) {
-  return path9.join(runtimeDir(root), "browser", "screenshots");
-}
-function checkUrl(url, cfg = DEFAULT_CONFIG2) {
-  if (typeof url !== "string" || url.trim() === "") {
-    return { ok: false, reason: "empty_url" };
-  }
-  for (const pat of cfg.block) {
+// lib/file-lock.ts
+import { promises as fs8 } from "node:fs";
+import * as crypto3 from "node:crypto";
+import * as os4 from "node:os";
+import * as path10 from "node:path";
+async function withFileLock(lockPath, fn, opts = {}) {
+  const retryMs = opts.retryMs ?? 50;
+  const timeoutMs = opts.timeoutMs ?? 1e4;
+  const staleMs = opts.staleMs ?? 300000;
+  await fs8.mkdir(path10.dirname(lockPath), { recursive: true });
+  const deadline = Date.now() + timeoutMs;
+  const myHost = os4.hostname();
+  const myToken = crypto3.randomBytes(16).toString("hex");
+  let acquired = false;
+  while (!acquired) {
     try {
-      if (new RegExp(pat).test(url)) {
-        return { ok: false, reason: `blocked: matches ${pat}` };
+      const handle = await fs8.open(lockPath, "wx");
+      try {
+        const meta = {
+          pid: process.pid,
+          host: myHost,
+          token: myToken,
+          acquired_at: new Date().toISOString()
+        };
+        await handle.writeFile(JSON.stringify(meta), "utf8");
+        await handle.close();
+      } catch (writeErr) {
+        await handle.close().catch(() => {});
+        await fs8.rm(lockPath, { force: true }).catch(() => {});
+        throw writeErr;
       }
-    } catch {}
+      acquired = true;
+    } catch (err) {
+      const e = err;
+      if (e.code !== "EEXIST")
+        throw err;
+      const cleaned = await tryCleanStaleLock(lockPath, staleMs, myHost);
+      if (cleaned)
+        continue;
+      if (Date.now() >= deadline) {
+        throw new Error(`withFileLock: 等待 ${lockPath} 超过 ${timeoutMs}ms 仍未拿到锁`);
+      }
+      await sleep(retryMs);
+    }
   }
-  if (cfg.allow.length === 0)
-    return { ok: true };
-  for (const pat of cfg.allow) {
-    try {
-      if (new RegExp(pat).test(url))
-        return { ok: true };
-    } catch {}
+  try {
+    return await fn();
+  } finally {
+    await releaseLockSafely(lockPath, myToken).catch(() => {});
   }
-  return { ok: false, reason: "not_in_allow_list" };
 }
-
-class NoopBrowserController {
-  reason;
-  constructor(reason = "browser is disabled (set tools.browser.enabled=true to use)") {
-    this.reason = reason;
+async function tryCleanStaleLock(lockPath, staleMs, myHost) {
+  let mtimeMs;
+  try {
+    const st = await fs8.stat(lockPath);
+    mtimeMs = st.mtimeMs;
+  } catch {
+    return true;
   }
-  async navigate(url) {
-    return { ok: false, url, error: this.reason };
+  const age = Date.now() - mtimeMs;
+  if (age <= staleMs)
+    return false;
+  let meta = null;
+  try {
+    const raw = await fs8.readFile(lockPath, "utf8");
+    meta = JSON.parse(raw);
+  } catch {
+    meta = null;
   }
-  async screenshot() {
-    return { ok: false, error: this.reason };
+  if (meta && meta.host === myHost && typeof meta.pid === "number" && meta.pid > 0) {
+    try {
+      process.kill(meta.pid, 0);
+      return false;
+    } catch (err) {
+      const e = err;
+      if (e.code === "EPERM")
+        return false;
+    }
   }
-  async click(selector) {
-    return { ok: false, selector, found: false, error: this.reason };
+  return await deleteIfMtimeMatch(lockPath, mtimeMs);
+}
+async function deleteIfMtimeMatch(lockPath, expectedMtimeMs) {
+  try {
+    const st = await fs8.stat(lockPath);
+    if (st.mtimeMs !== expectedMtimeMs) {
+      return false;
+    }
+  } catch {
+    return true;
   }
-  async fill(selector, _value) {
-    return { ok: false, selector, found: false, error: this.reason };
+  await fs8.rm(lockPath, { force: true }).catch(() => {});
+  return true;
+}
+async function releaseLockSafely(lockPath, myToken) {
+  let raw;
+  try {
+    raw = await fs8.readFile(lockPath, "utf8");
+  } catch {
+    return;
   }
-  async consoleLogs() {
-    return [];
+  let meta;
+  try {
+    meta = JSON.parse(raw);
+  } catch {
+    return;
   }
-  async networkRequests() {
-    return [];
+  if (meta.token === myToken) {
+    await fs8.rm(lockPath, { force: true });
   }
-  async close() {}
 }
-async function tryCreatePlaywrightController(cfg = DEFAULT_CONFIG2, resolver = defaultPlaywrightResolver) {
-  if (!cfg.enabled)
-    return null;
-  let mod;
+function sleep(ms) {
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
+}
+
+// lib/session-worktree.ts
+var REGISTRY_VERSION = 1;
+var DEFAULT_WORKTREE_SUBDIR = path11.join(".git", "codeforge-worktrees");
+function debugLog(msg) {
+  if (process.env["CODEFORGE_DEBUG"]) {
+    console.debug(`[session-worktree] ${msg}`);
+  }
+}
+function registryDir(mainRoot) {
+  return path11.join(runtimeDir(path11.resolve(mainRoot), { ensure: false }), "session-worktrees");
+}
+function registryPath(mainRoot) {
+  return path11.join(registryDir(mainRoot), "registry.json");
+}
+function registryLockPath(mainRoot) {
+  return path11.join(registryDir(mainRoot), "registry.lock");
+}
+async function readRegistry(mainRoot) {
+  const file = registryPath(mainRoot);
   try {
-    mod = await resolver();
-  } catch {
-    return null;
+    const raw = await fs9.readFile(file, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== REGISTRY_VERSION || !Array.isArray(parsed.entries)) {
+      return { version: REGISTRY_VERSION, entries: [] };
+    }
+    return parsed;
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT")
+      return { version: REGISTRY_VERSION, entries: [] };
+    return { version: REGISTRY_VERSION, entries: [] };
   }
-  if (!mod || typeof mod !== "object")
-    return null;
-  const chromium = mod.chromium;
-  if (!chromium || typeof chromium.launch !== "function")
-    return null;
-  const browser = await chromium.launch({ headless: cfg.headless });
-  const context = await browser.newContext();
-  const page = await context.newPage();
-  const consoleBuf = [];
-  const networkBuf = [];
-  page.on?.("console", (...args) => {
-    const msg = args[0];
-    consoleBuf.push({
-      level: normalizeLevel(msg.type?.()),
-      text: msg.text?.() ?? "",
-      timestamp: Date.now()
-    });
-    if (consoleBuf.length > cfg.bufferLimit)
-      consoleBuf.splice(0, consoleBuf.length - cfg.bufferLimit);
+}
+async function writeRegistry(mainRoot, reg) {
+  const file = registryPath(mainRoot);
+  await fs9.mkdir(path11.dirname(file), { recursive: true });
+  const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
+  await fs9.writeFile(tmp, JSON.stringify(reg, null, 2), "utf8");
+  await fs9.rename(tmp, file);
+}
+async function mutateRegistry(mainRoot, fn) {
+  const lockPath = registryLockPath(mainRoot);
+  await fs9.mkdir(path11.dirname(lockPath), { recursive: true });
+  return await withFileLock(lockPath, async () => {
+    const reg = await readRegistry(mainRoot);
+    const result = await fn(reg);
+    await writeRegistry(mainRoot, reg);
+    return result;
   });
-  page.on?.("request", (...args) => {
-    const req = args[0];
-    networkBuf.push({
-      url: req.url(),
-      method: req.method(),
-      start_ts: Date.now()
+}
+async function bindSessionWorktree(opts) {
+  if (!opts.sessionId || opts.sessionId.trim() === "") {
+    throw new Error("bindSessionWorktree: sessionId 不能为空");
+  }
+  const mainRoot = path11.resolve(opts.mainRoot);
+  const branch = opts.branchName ?? `codeforge/session-${opts.sessionId}`;
+  const worktreesDir = opts.worktrees_dir ?? path11.join(mainRoot, DEFAULT_WORKTREE_SUBDIR);
+  const lockPath = registryLockPath(mainRoot);
+  await fs9.mkdir(path11.dirname(lockPath), { recursive: true });
+  return await withFileLock(lockPath, async () => {
+    const reg = await readRegistry(mainRoot);
+    const existing = reg.entries.find((e) => e.sessionId === opts.sessionId);
+    if (existing && existing.status === "active")
+      return existing;
+    const baseSha = (await runGit2(mainRoot, ["rev-parse", "HEAD"])).trim();
+    const wt = await ensureWorktree({
+      root: mainRoot,
+      branch,
+      worktrees_dir: worktreesDir
     });
-    if (networkBuf.length > cfg.bufferLimit)
-      networkBuf.splice(0, networkBuf.length - cfg.bufferLimit);
-  });
-  page.on?.("response", (...args) => {
-    const res = args[0];
-    const item = networkBuf.find((n) => n.url === res.url() && n.end_ts === undefined);
-    if (item) {
-      item.status = res.status();
-      item.end_ts = Date.now();
-    }
-  });
-  page.on?.("requestfailed", (...args) => {
-    const req = args[0];
-    const item = networkBuf.find((n) => n.url === req.url() && n.end_ts === undefined);
-    if (item) {
-      item.failed = req.failure?.()?.errorText ?? "failed";
-      item.end_ts = Date.now();
-    }
+    const now = new Date().toISOString();
+    const entry = {
+      sessionId: opts.sessionId,
+      branch,
+      worktreePath: wt.path,
+      baseSha,
+      ...opts.requiredPlanId ? { requiredPlanId: opts.requiredPlanId, planReadOk: false } : {},
+      status: "active",
+      createdAt: now,
+      updatedAt: now
+    };
+    const idx = reg.entries.findIndex((e) => e.sessionId === opts.sessionId);
+    if (idx >= 0)
+      reg.entries[idx] = entry;
+    else
+      reg.entries.push(entry);
+    await writeRegistry(mainRoot, reg);
+    return entry;
   });
-  return {
-    async navigate(url) {
-      const c = checkUrl(url, cfg);
-      if (!c.ok)
-        return { ok: false, url, error: c.reason };
-      const start = Date.now();
-      try {
-        const resp = await page.goto(url, { timeout: cfg.actionTimeoutMs });
-        return {
-          ok: true,
-          url,
-          status: resp?.status?.() ?? 200,
-          loaded_in_ms: Date.now() - start
-        };
-      } catch (err) {
-        return { ok: false, url, error: describe3(err) };
-      }
-    },
-    async screenshot(opts) {
-      try {
-        const dir = cfg.screenshotDir && cfg.screenshotDir.trim().length > 0 ? cfg.screenshotDir : defaultScreenshotDir();
-        const path10 = `${dir}/${Date.now()}.png`;
-        if (opts?.selector) {
-          const el = await page.locator(opts.selector).first();
-          await el.screenshot({ path: path10 });
-        } else {
-          await page.screenshot({ path: path10, fullPage: opts?.fullPage });
-        }
-        return { ok: true, path: path10 };
-      } catch (err) {
-        return { ok: false, error: describe3(err) };
-      }
-    },
-    async click(selector) {
-      try {
-        await page.locator(selector).first().click({ timeout: cfg.actionTimeoutMs });
-        return { ok: true, selector, found: true };
-      } catch (err) {
-        return { ok: false, selector, found: false, error: describe3(err) };
-      }
-    },
-    async fill(selector, value) {
-      try {
-        await page.locator(selector).first().fill(value, { timeout: cfg.actionTimeoutMs });
-        return { ok: true, selector, found: true };
-      } catch (err) {
-        return { ok: false, selector, found: false, error: describe3(err) };
-      }
-    },
-    async consoleLogs(opts = {}) {
-      return consoleBuf.filter((e) => (opts.sinceTs === undefined || e.timestamp >= opts.sinceTs) && (opts.level === undefined || e.level === opts.level));
-    },
-    async networkRequests(opts = {}) {
-      return networkBuf.filter((e) => (opts.sinceTs === undefined || e.start_ts >= opts.sinceTs) && (opts.method === undefined || e.method.toUpperCase() === opts.method.toUpperCase()));
-    },
-    async close() {
-      try {
-        await context.close();
-      } catch {}
-      try {
-        await browser.close();
-      } catch {}
-    }
-  };
 }
-async function defaultPlaywrightResolver() {
-  return await import("playwright");
+async function getSessionWorktree(sessionId, mainRoot) {
+  const reg = await readRegistry(mainRoot);
+  return reg.entries.find((e) => e.sessionId === sessionId) ?? null;
 }
-function normalizeLevel(t) {
-  switch (t) {
-    case "info":
-    case "warn":
-    case "error":
-    case "debug":
-      return t;
-    default:
-      return "log";
-  }
+async function markPlanReadOk(opts) {
+  return await mutateRegistry(opts.mainRoot, (reg) => {
+    const entry = reg.entries.find((e) => e.sessionId === opts.sessionId);
+    if (!entry || entry.requiredPlanId !== opts.planId)
+      return false;
+    entry.planReadOk = true;
+    entry.updatedAt = new Date().toISOString();
+    return true;
+  });
 }
-function describe3(err) {
-  if (err instanceof Error)
-    return err.message;
-  if (typeof err === "string")
-    return err;
-  try {
-    return JSON.stringify(err);
-  } catch {
-    return String(err);
-  }
+async function touchEntryUpdatedAt(opts) {
+  return await mutateRegistry(opts.mainRoot, (reg) => {
+    const entry = reg.entries.find((e) => e.sessionId === opts.sessionId);
+    if (!entry || entry.status !== "active")
+      return false;
+    entry.updatedAt = new Date().toISOString();
+    return true;
+  });
 }
-async function createBrowserController(opts = {}) {
-  const cfg = { ...DEFAULT_CONFIG2, ...opts.cfg };
-  if (!cfg.enabled) {
-    return new NoopBrowserController("browser disabled in config");
+async function mergeSessionBack(opts) {
+  const mainRoot = path11.resolve(opts.mainRoot);
+  const entry = await getSessionWorktree(opts.sessionId, mainRoot);
+  if (!entry) {
+    throw new Error(`mergeSessionBack: session ${opts.sessionId} 没有绑定 worktree`);
   }
-  if (opts.factory) {
-    const c = await opts.factory(cfg);
-    if (c)
-      return c;
+  if (entry.status === "interrupted_dirty") {
+    throw new Error(`mergeSessionBack: session ${opts.sessionId} 处于 interrupted_dirty 状态，` + `请先手动处理 worktree (${entry.worktreePath}) 后再 merge`);
   }
-  const playwright = await tryCreatePlaywrightController(cfg);
-  if (playwright)
-    return playwright;
-  return new NoopBrowserController("browser enabled but no driver available (npm i playwright 后重试)");
-}
-
-// tools/browser-navigate.ts
-var description5 = [
-  "打开指定 URL（受 tools.browser 配置控制；默认禁用）。",
-  "**何时调用**：需要看 web 页面真实渲染、调试前端、复现 bug 报告链接。",
-  "**注意**：仅允许 http/https；file:/data: 等协议被默认安全策略拒绝。"
-].join(`
-`);
-var ArgsSchema5 = z5.object({
-  url: z5.string().min(1).describe("要打开的 URL；必须是 http(s) 协议")
-});
-var _controller = null;
-var _cfg;
-async function getController() {
-  if (!_controller) {
-    _controller = await createBrowserController({ cfg: _cfg });
+  if (entry.status !== "active") {
+    throw new Error(`mergeSessionBack: session ${opts.sessionId} 状态为 ${entry.status}，无法 merge`);
   }
-  return _controller;
-}
-async function execute5(input) {
-  const parsed = ArgsSchema5.safeParse(input);
-  if (!parsed.success) {
-    return {
-      ok: false,
-      url: typeof input?.url === "string" ? String(input.url) : "",
-      error: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")
-    };
+  const wt = entry.worktreePath;
+  const branch = entry.branch;
+  const baseSha = entry.baseSha;
+  const wtStatus = (await runGit2(wt, ["status", "--porcelain"])).trim();
+  if (wtStatus.length > 0) {
+    await runGit2(wt, ["add", "-A"]);
+    await runGit2(wt, ["commit", "-m", `session(${opts.sessionId}): auto-commit before merge`]);
+  }
+  const mainStatus = (await runGit2(mainRoot, ["status", "--porcelain"])).trim();
+  if (mainStatus.length > 0) {
+    throw new Error(`mergeSessionBack: 主仓 ${mainRoot} 有未提交改动，请先 commit/stash 后再 merge`);
   }
   try {
-    const ctrl = await getController();
-    return await ctrl.navigate(parsed.data.url);
+    await runGit2(mainRoot, ["merge", "--squash", branch]);
   } catch (err) {
-    return {
-      ok: false,
-      url: parsed.data.url,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-// tools/browser-click.ts
-import { z as z6 } from "zod";
-var description6 = [
-  "点击页面元素。属于「写操作」，semi 模式下应当让用户确认。",
-  "**何时调用**：表单提交、按钮触发、SPA 导航。",
-  "**避坑**：selector 优先用稳定属性（data-testid > role > 文本 > id），尽量不用 xpath。"
-].join(`
-`);
-var ArgsSchema6 = z6.object({
-  selector: z6.string().min(1).describe("CSS / Playwright locator 字符串，必须能唯一定位")
-});
-var _controller2 = null;
-var _cfg2;
-async function getController2() {
-  if (!_controller2) {
-    _controller2 = await createBrowserController({ cfg: _cfg2 });
-  }
-  return _controller2;
-}
-async function execute6(input) {
-  const parsed = ArgsSchema6.safeParse(input);
-  if (!parsed.success) {
-    return {
-      ok: false,
-      selector: typeof input?.selector === "string" ? String(input.selector) : "",
-      found: false,
-      error: parsed.error.issues.map((i) => i.message).join("; ")
-    };
+    await runGit2(mainRoot, ["reset", "--merge"]).catch(() => {
+      return runGit2(mainRoot, ["reset", "--hard", "HEAD"]).catch(() => {});
+    });
+    throw new Error(`mergeSessionBack: squash merge 失败（已 reset 主仓兜底）: ${err.message}`);
   }
+  const buildScript = await getBuildScript(mainRoot);
+  if (buildScript) {
+    const stagedRaw = await runGit2(mainRoot, [
+      "diff",
+      "--cached",
+      "--name-only",
+      "--diff-filter=ACMR"
+    ]);
+    const stagedPaths = stagedRaw.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+    const canSkipDevOnce = await shouldSkipDevOnce(mainRoot, stagedPaths, wt);
+    if (canSkipDevOnce) {} else {
+      try {
+        await runCmd("npm", ["run", buildScript], mainRoot);
+      } catch (err) {
+        await runGit2(mainRoot, ["reset", "--hard", "HEAD"]).catch(() => {});
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`${buildScript} 失败已 reset 主仓: ${msg}`);
+      }
+    }
+  } else {}
+  const squashedRaw = await runGit2(wt, ["log", "--format=%s", `${baseSha}..HEAD`]);
+  const squashedCommits = squashedRaw.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+  const message = opts.commitMessage ?? buildMergeMessage(opts.sessionId, branch, baseSha, squashedCommits);
+  await runGitWithEnv(mainRoot, ["commit", "-m", message], {
+    SKIP_DEV_SYNC_CHECK: "1"
+  });
+  const newSha = (await runGit2(mainRoot, ["rev-parse", "HEAD"])).trim();
   try {
-    const ctrl = await getController2();
-    return await ctrl.click(parsed.data.selector);
+    await removeWorktree({ root: mainRoot, worktree_path: wt, force: true });
   } catch (err) {
-    return {
-      ok: false,
-      selector: parsed.data.selector,
-      found: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
+    debugLog(`removeWorktree (merge) 非预期失败 (session=${opts.sessionId}): ${err.message}`);
   }
-}
-// tools/browser-fill.ts
-import { z as z7 } from "zod";
-var description7 = [
-  "向 input/textarea/contenteditable 元素写入文本。",
-  "**何时调用**：登录表单、搜索框、富文本初始化。",
-  "**安全**：value 不会被自动 mask；不要把真实凭据塞进来。"
-].join(`
-`);
-var ArgsSchema7 = z7.object({
-  selector: z7.string().min(1).describe("CSS / Playwright locator"),
-  value: z7.string().describe("要填入的文本；原样写入，不做转义")
-});
-var _controller3 = null;
-var _cfg3;
-async function getController3() {
-  if (!_controller3) {
-    _controller3 = await createBrowserController({ cfg: _cfg3 });
+  await deleteBranchIfExists({ root: mainRoot, branch }).catch((err) => {
+    debugLog(`deleteBranchIfExists (merge) 非预期失败: ${err.message}`);
+    return { deleted: false };
+  });
+  await mutateRegistry(mainRoot, (reg) => {
+    const e = reg.entries.find((x) => x.sessionId === opts.sessionId);
+    if (e) {
+      e.status = "merged";
+      e.updatedAt = new Date().toISOString();
+    }
+  });
+  if (opts.planStore && entry.requiredPlanId) {
+    await opts.planStore.markMerged(entry.requiredPlanId, opts.sessionId).catch((err) => {
+      console.warn(`[session-worktree] planStore.markMerged(${entry.requiredPlanId}) 失败: ${err instanceof Error ? err.message : String(err)}`);
+    });
   }
-  return _controller3;
+  return { sha: newSha, squashedCommits };
 }
-async function execute7(input) {
-  const parsed = ArgsSchema7.safeParse(input);
-  if (!parsed.success) {
-    return {
-      ok: false,
-      selector: typeof input?.selector === "string" ? String(input.selector) : "",
-      found: false,
-      error: parsed.error.issues.map((i) => i.message).join("; ")
-    };
+async function discardSession(opts) {
+  const mainRoot = path11.resolve(opts.mainRoot);
+  const entry = await getSessionWorktree(opts.sessionId, mainRoot);
+  if (!entry) {
+    return;
+  }
+  if (entry.status === "merged" || entry.status === "discarded") {
+    return;
   }
   try {
-    const ctrl = await getController3();
-    return await ctrl.fill(parsed.data.selector, parsed.data.value);
+    await removeWorktree({
+      root: mainRoot,
+      worktree_path: entry.worktreePath,
+      force: true
+    });
   } catch (err) {
-    return {
-      ok: false,
-      selector: parsed.data.selector,
-      found: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
+    debugLog(`removeWorktree (discard) 非预期失败: ${err.message}`);
   }
-}
-// tools/browser-screenshot.ts
-import { z as z8 } from "zod";
-var description8 = [
-  "截取当前页面（或指定元素）的屏幕快照。",
-  "**何时调用**：前端 dev 调试、回归对比、用户报 bug 没截图时让 agent 自取。",
-  "**注意**：必须先 navigate；输出路径写到 runtime 目录的 browser/screenshots/（XDG 全局位置，详见 lib/runtime-paths.ts）。"
-].join(`
-`);
-var ArgsSchema8 = z8.object({
-  fullPage: z8.boolean().optional().describe("是否截全长页面（默认仅可视区）"),
-  selector: z8.string().optional().describe("CSS 选择器；指定时只截该元素")
-});
-var _controller4 = null;
-var _cfg4;
-async function getController4() {
-  if (!_controller4) {
-    _controller4 = await createBrowserController({ cfg: _cfg4 });
+  await deleteBranchIfExists({ root: mainRoot, branch: entry.branch }).catch((err) => {
+    debugLog(`deleteBranchIfExists (discard) 非预期失败: ${err.message}`);
+    return { deleted: false };
+  });
+  await mutateRegistry(mainRoot, (reg) => {
+    const e = reg.entries.find((x) => x.sessionId === opts.sessionId);
+    if (e) {
+      e.status = "discarded";
+      e.updatedAt = new Date().toISOString();
+    }
+  });
+  if (opts.planStore && entry.requiredPlanId) {
+    await opts.planStore.markDiscarded(entry.requiredPlanId, opts.sessionId).catch((err) => {
+      console.warn(`[session-worktree] planStore.markDiscarded(${entry.requiredPlanId}) 失败: ${err instanceof Error ? err.message : String(err)}`);
+    });
   }
-  return _controller4;
 }
-async function execute8(input) {
-  const parsed = ArgsSchema8.safeParse(input);
-  if (!parsed.success) {
-    return { ok: false, error: parsed.error.issues.map((i) => i.message).join("; ") };
-  }
-  try {
-    const ctrl = await getController4();
-    return await ctrl.screenshot(parsed.data);
-  } catch (err) {
-    return { ok: false, error: err instanceof Error ? err.message : String(err) };
-  }
+async function markInterruptedDirty(opts) {
+  await mutateRegistry(opts.mainRoot, (reg) => {
+    const e = reg.entries.find((x) => x.sessionId === opts.sessionId);
+    if (e && e.status === "active") {
+      e.status = "interrupted_dirty";
+      e.updatedAt = new Date().toISOString();
+    }
+  });
 }
-// tools/browser-console.ts
-import { z as z9 } from "zod";
-var description9 = [
-  "读取浏览器控制台缓冲区（log/info/warn/error/debug）。",
-  "**何时调用**：调前端 bug、看页面 runtime error、跟 React/Vue 警告。",
-  "**注意**：缓冲区上限 500 条，超出会丢最早；只能读 navigate 之后的日志。"
-].join(`
-`);
-var ArgsSchema9 = z9.object({
-  level: z9.enum(["log", "info", "warn", "error", "debug"]).optional().describe("只过滤指定级别；缺省返回全部"),
-  sinceTs: z9.number().optional().describe("只返回 timestamp >= sinceTs 的条目")
-});
-var _controller5 = null;
-var _cfg5;
-async function getController5() {
-  if (!_controller5) {
-    _controller5 = await createBrowserController({ cfg: _cfg5 });
+async function getCurrentWorktreeHead(worktreePath) {
+  try {
+    return (await runGit2(path11.resolve(worktreePath), ["rev-parse", "HEAD"])).trim();
+  } catch {
+    return "";
   }
-  return _controller5;
 }
-async function execute9(input) {
-  const parsed = ArgsSchema9.safeParse(input);
-  if (!parsed.success) {
-    return {
-      ok: false,
-      entries: [],
-      error: parsed.error.issues.map((i) => i.message).join("; ")
-    };
-  }
+async function isWorktreeDirty(worktreePath) {
   try {
-    const ctrl = await getController5();
-    const entries = await ctrl.consoleLogs(parsed.data);
-    return { ok: true, entries };
-  } catch (err) {
-    return {
-      ok: false,
-      entries: [],
-      error: err instanceof Error ? err.message : String(err)
-    };
+    const out = (await runGit2(worktreePath, ["status", "--porcelain"])).trim();
+    return out.length > 0;
+  } catch {
+    return false;
   }
 }
-// tools/browser-network.ts
-import { z as z10 } from "zod";
-var description10 = [
-  "读取浏览器网络请求缓冲区（含 status / 失败原因 / 耗时）。",
-  "**何时调用**：调 API 调用 4xx/5xx、CORS 报错、查 page 加载耗时分布。",
-  "**注意**：缓冲区上限 500 条；只看 navigate 之后发起的请求。"
-].join(`
-`);
-var ArgsSchema10 = z10.object({
-  method: z10.string().optional().describe("HTTP 方法过滤（GET/POST/...），不区分大小写"),
-  sinceTs: z10.number().optional().describe("只返回 start_ts >= sinceTs 的请求")
-});
-var _controller6 = null;
-var _cfg6;
-async function getController6() {
-  if (!_controller6) {
-    _controller6 = await createBrowserController({ cfg: _cfg6 });
-  }
-  return _controller6;
+async function checkpointCommit(opts) {
+  await runGit2(opts.worktreePath, ["add", "-A"]);
+  await runGit2(opts.worktreePath, ["commit", "-m", opts.message]);
 }
-async function execute10(input) {
-  const parsed = ArgsSchema10.safeParse(input);
-  if (!parsed.success) {
-    return {
-      ok: false,
-      entries: [],
-      error: parsed.error.issues.map((i) => i.message).join("; ")
-    };
-  }
-  try {
-    const ctrl = await getController6();
-    const entries = await ctrl.networkRequests(parsed.data);
-    return { ok: true, entries };
-  } catch (err) {
-    return {
-      ok: false,
-      entries: [],
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-// tools/model-chain.ts
-import { z as z11 } from "zod";
-
-// lib/model-config.ts
-import { promises as fs7 } from "node:fs";
-import * as path10 from "node:path";
-
-// lib/model-tier.ts
-var TIER_ORDER = ["quick", "balanced", "deep", "ultra"];
-
-// lib/model-config.ts
-var CONFIG_FILE = "codeforge.json";
-var DEFAULT_RUNTIME_FALLBACK = {
-  enabled: true,
-  max_fallback_attempts: 3,
-  notify_on_fallback: true,
-  trigger_events: ["session.error", "model.unavailable", "model.rate_limited"]
-};
-var PROVIDER_MODEL_RE = /^[a-z0-9-]+\/[a-zA-Z0-9._-]+$/;
-function findConfigFileSync(opts = {}) {
-  const root = opts.root ?? process.cwd();
-  const fsSync = __require("node:fs");
-  const abs = path10.resolve(root, opts.file ?? CONFIG_FILE);
-  return fsSync.existsSync(abs) ? abs : null;
+function runGit2(cwd, args, timeoutMs = 1e4) {
+  return new Promise((resolve10, reject) => {
+    execFile3("git", args, { cwd, timeout: timeoutMs, windowsHide: true, encoding: "utf8" }, (err, stdout, stderr) => {
+      if (err) {
+        reject(new Error(`git ${args.join(" ")} (cwd=${cwd}) 失败: ${stderr?.trim() || err.message}`));
+        return;
+      }
+      resolve10(stdout);
+    });
+  });
 }
-function loadModelConfigSync(opts = {}) {
-  const root = opts.root ?? process.cwd();
-  const abs = path10.resolve(root, opts.file ?? CONFIG_FILE);
-  const fsSync = __require("node:fs");
-  if (!fsSync.existsSync(abs)) {
-    return { ok: false, warnings: [], error: `config_not_found: ${abs}` };
-  }
-  let raw;
-  try {
-    raw = fsSync.readFileSync(abs, "utf8");
-  } catch (e) {
-    return { ok: false, path: abs, warnings: [], error: `read_failed: ${e.message}` };
-  }
-  return parseAndValidate(raw, abs);
+function runGitWithEnv(cwd, args, envOverrides, timeoutMs = 1e4) {
+  const inheritedEnv = process["env"];
+  return new Promise((resolve10, reject) => {
+    execFile3("git", args, {
+      cwd,
+      timeout: timeoutMs,
+      windowsHide: true,
+      encoding: "utf8",
+      env: Object.assign({}, inheritedEnv, envOverrides)
+    }, (err, stdout, stderr) => {
+      if (err) {
+        reject(new Error(`git ${args.join(" ")} (cwd=${cwd}) 失败: ${stderr?.trim() || err.message}`));
+        return;
+      }
+      resolve10(stdout);
+    });
+  });
 }
-async function loadModelConfig(opts = {}) {
-  const root = opts.root ?? process.cwd();
-  const abs = path10.resolve(root, opts.file ?? CONFIG_FILE);
-  let raw;
-  try {
-    raw = await fs7.readFile(abs, "utf8");
-  } catch (e) {
-    const code = e.code;
-    if (code === "ENOENT") {
-      return { ok: false, path: abs, warnings: [], error: `config_not_found: ${abs}` };
-    }
-    return { ok: false, path: abs, warnings: [], error: `read_failed: ${e.message}` };
-  }
-  return parseAndValidate(raw, abs);
+async function getBuildScript(mainRoot) {
+  const cfg = getCodeforgeConfig({ root: mainRoot });
+  const merge = cfg["merge"];
+  if (!merge || typeof merge !== "object" || Array.isArray(merge))
+    return null;
+  const script = merge["postMergeScript"];
+  if (typeof script !== "string")
+    return null;
+  const trimmed = script.trim();
+  return trimmed.length > 0 ? trimmed : null;
 }
-function parseAndValidate(raw, abs) {
-  let parsed;
+async function shouldSkipDevOnce(mainRoot, stagedPaths, worktreePath) {
+  let distMtimeSec;
   try {
-    parsed = JSON.parse(raw);
-  } catch (e) {
-    return { ok: false, path: abs, warnings: [], error: `invalid_json: ${e.message}` };
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return { ok: false, path: abs, warnings: [], error: "invalid_root: must be an object" };
+    const st = await fs9.stat(path11.join(mainRoot, "dist/index.js"));
+    distMtimeSec = Math.floor(st.mtimeMs / 1000);
+  } catch {
+    return false;
   }
-  const root = parsed;
-  const modelsNode = root.models;
-  if (!modelsNode || typeof modelsNode !== "object" || Array.isArray(modelsNode)) {
-    return { ok: false, path: abs, warnings: [], error: "missing_models: codeforge.json must have a top-level `models` object" };
+  const relevant = stagedPaths.filter((p) => /^(plugins|lib|src)\//.test(p) && !/\.(md|test\.ts)$/.test(p));
+  if (relevant.length === 0)
+    return true;
+  for (const rel of relevant) {
+    const srcMtimeSec = await statSourceMtime(rel, mainRoot, worktreePath);
+    if (srcMtimeSec === null)
+      return false;
+    if (srcMtimeSec > distMtimeSec)
+      return false;
   }
-  const v = validateConfig(modelsNode);
-  if (!v.ok)
-    return { ok: false, path: abs, warnings: [], error: v.error };
-  return { ok: true, path: abs, config: v.config, warnings: v.warnings };
+  return true;
 }
-function validateConfig(input) {
-  const warnings = [];
-  if (!input || typeof input !== "object" || Array.isArray(input)) {
-    return { ok: false, warnings, error: "config_root_must_be_object" };
-  }
-  const obj = input;
-  const agentsRaw = obj.agents;
-  if (!agentsRaw || typeof agentsRaw !== "object" || Array.isArray(agentsRaw)) {
-    return { ok: false, warnings, error: "agents_required_object" };
-  }
-  const agents = {};
-  for (const [name, value] of Object.entries(agentsRaw)) {
-    const r = normalizeAgent(name, value);
-    if (!r.ok)
-      return { ok: false, warnings, error: r.error };
-    agents[name] = r.binding;
-  }
-  if (Object.keys(agents).length === 0) {
-    return { ok: false, warnings, error: "agents_must_have_at_least_one_entry" };
-  }
-  let categories;
-  if (obj.categories !== undefined) {
-    if (!obj.categories || typeof obj.categories !== "object" || Array.isArray(obj.categories)) {
-      return { ok: false, warnings, error: "categories_must_be_object" };
-    }
-    categories = {};
-    for (const [name, value] of Object.entries(obj.categories)) {
-      const r = normalizeCategory(name, value);
-      if (!r.ok)
-        return { ok: false, warnings, error: r.error };
-      categories[name] = r.binding;
-    }
-  }
-  let runtime;
-  if (obj.runtime_fallback !== undefined) {
-    const r = normalizeRuntime(obj.runtime_fallback);
-    if (!r.ok)
-      return { ok: false, warnings, error: r.error };
-    runtime = r.cfg;
-  }
-  let tiers;
-  if (obj.tiers !== undefined) {
-    const r = normalizeTiers(obj.tiers);
-    if (!r.ok)
-      return { ok: false, warnings, error: r.error };
-    tiers = r.cfg;
+async function statSourceMtime(rel, mainRoot, worktreePath) {
+  if (worktreePath) {
+    try {
+      const st = await fs9.stat(path11.join(worktreePath, rel));
+      return Math.floor(st.mtimeMs / 1000);
+    } catch {}
   }
-  for (const [name, agent] of Object.entries(agents)) {
-    if (agent.category && !categories?.[agent.category]) {
-      warnings.push(`agent[${name}].category="${agent.category}" 未在 categories 定义，将忽略 category 链`);
-    }
+  try {
+    const st = await fs9.stat(path11.join(mainRoot, rel));
+    return Math.floor(st.mtimeMs / 1000);
+  } catch {
+    return null;
   }
-  for (const [name, agent] of Object.entries(agents)) {
-    if (!agent.tier)
-      continue;
-    const mappedCat = tiers?.category_map?.[agent.tier];
-    const hasOverride = agent.tier_overrides?.[agent.tier] !== undefined;
-    if (!mappedCat && !hasOverride) {
-      warnings.push(`agent[${name}].tier="${agent.tier}" 既无 models.tiers.category_map["${agent.tier}"] 映射，` + `也无 tier_overrides["${agent.tier}"]；该 agent 将不参与 tier 体系（adapter 返 null）。`);
-    } else if (mappedCat && !categories?.[mappedCat] && !hasOverride) {
-      warnings.push(`agent[${name}].tier="${agent.tier}" 通过 category_map 映射到 "${mappedCat}"，` + `但 categories.${mappedCat} 不存在；该 agent 将不参与 tier 体系。`);
-    }
+}
+function runCmd(cmd, args, cwd, timeoutMs = 300000) {
+  return new Promise((resolve10, reject) => {
+    execFile3(cmd, args, { cwd, timeout: timeoutMs, windowsHide: true, encoding: "utf8" }, (err, stdout, stderr) => {
+      if (err) {
+        reject(new Error(`${cmd} ${args.join(" ")} (cwd=${cwd}) 失败: ${stderr?.trim() || err.message}`));
+        return;
+      }
+      resolve10(stdout);
+    });
+  });
+}
+function buildMergeMessage(sessionId, branch, baseSha, squashed) {
+  const subject = `session(${sessionId}): merge ${branch}`;
+  const body = squashed.length > 0 ? `
+
+Squashed commits:
+${squashed.map((s) => `  - ${s}`).join(`
+`)}` : "";
+  const footer = `
+
+Codeforge-Session: ${sessionId}
+Codeforge-Base: ${baseSha.slice(0, 12)}`;
+  return subject + body + footer;
+}
+var ORPHAN_GRACE_MS = 60000;
+var SEMANTIC_ORPHAN_MIN_AGE_MS = 6 * 60 * 60000;
+var SEMANTIC_ORPHAN_UNKNOWN_TIMEOUT_MS = 72 * 60 * 60000;
+async function pruneDiscardedRegistryEntries(mainRoot, opts = {}) {
+  const keepRecent = opts.keepRecent ?? 50;
+  if (keepRecent < 0) {
+    throw new Error(`pruneDiscardedRegistryEntries: keepRecent 必须 ≥ 0，收到 ${keepRecent}`);
   }
-  return {
-    ok: true,
-    warnings,
-    config: {
-      $schema: typeof obj.$schema === "string" ? obj.$schema : undefined,
-      _doc: typeof obj._doc === "string" ? obj._doc : undefined,
-      agents,
-      categories,
-      runtime_fallback: runtime,
-      tiers
+  return await mutateRegistry(path11.resolve(mainRoot), (reg) => {
+    const discarded = [];
+    const others = [];
+    for (const e of reg.entries) {
+      if (e.status === "discarded")
+        discarded.push(e);
+      else
+        others.push(e);
     }
-  };
+    discarded.sort((a, b) => a.updatedAt < b.updatedAt ? 1 : a.updatedAt > b.updatedAt ? -1 : 0);
+    const kept = discarded.slice(0, keepRecent);
+    const pruned = discarded.length - kept.length;
+    reg.entries = [...others, ...kept];
+    return { pruned, kept: kept.length };
+  });
 }
-function normalizeAgent(name, raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    return { ok: false, error: `agent[${name}]: must be object` };
+async function pruneOrphanWorktrees(mainRoot, opts = {}) {
+  const resolved = path11.resolve(mainRoot);
+  const cleaned = [];
+  const failed = [];
+  let skipped = 0;
+  let gitWorktrees = [];
+  try {
+    const mod = await Promise.resolve().then(() => (init_worktree_ops(), exports_worktree_ops));
+    gitWorktrees = await mod.listWorktrees({ root: resolved });
+  } catch {
+    gitWorktrees = [];
   }
-  const o = raw;
-  if (typeof o.model !== "string" || !PROVIDER_MODEL_RE.test(o.model)) {
+  const gitWorktreePaths = new Set(gitWorktrees.map((w) => path11.resolve(w.path)));
+  await mutateRegistry(resolved, async (reg2) => {
+    const now = Date.now();
+    for (const entry of reg2.entries) {
+      if (entry.status !== "active")
+        continue;
+      const wt = entry.worktreePath;
+      let dirExists = true;
+      let dirMtimeMs = 0;
+      try {
+        const st = await fs9.stat(wt);
+        dirExists = st.isDirectory();
+        dirMtimeMs = st.mtimeMs;
+      } catch {
+        dirExists = false;
+      }
+      if (dirExists && now - dirMtimeMs < ORPHAN_GRACE_MS) {
+        skipped++;
+        continue;
+      }
+      let branchExists = true;
+      try {
+        await runGit2(resolved, ["rev-parse", "--verify", `refs/heads/${entry.branch}`]);
+      } catch {
+        branchExists = false;
+      }
+      if (!dirExists || !branchExists) {
+        const reason = !dirExists ? "worktreePath 不存在" : "branch 不存在";
+        entry.status = "discarded";
+        entry.updatedAt = new Date().toISOString();
+        if (dirExists) {
+          try {
+            await removeWorktree({
+              root: resolved,
+              worktree_path: wt,
+              force: true
+            });
+          } catch (err) {
+            failed.push({
+              worktreePath: wt,
+              error: err instanceof Error ? err.message : String(err)
+            });
+          }
+        }
+        cleaned.push({ sessionId: entry.sessionId, worktreePath: wt, reason });
+      }
+    }
+  });
+  if (opts.isSessionAlive) {
+    const minAge = opts.semanticOrphanMinAgeMs ?? SEMANTIC_ORPHAN_MIN_AGE_MS;
+    const unknownTimeout = opts.semanticOrphanUnknownTimeoutMs ?? SEMANTIC_ORPHAN_UNKNOWN_TIMEOUT_MS;
+    const probe = opts.isSessionAlive;
+    await mutateRegistry(resolved, async (reg2) => {
+      const now = Date.now();
+      for (const entry of reg2.entries) {
+        if (entry.status !== "active")
+          continue;
+        const updatedMs = Date.parse(entry.updatedAt);
+        if (!Number.isFinite(updatedMs) || now - updatedMs < minAge) {
+          skipped++;
+          continue;
+        }
+        let aliveResult;
+        try {
+          aliveResult = await probe(entry.sessionId);
+        } catch {
+          skipped++;
+          continue;
+        }
+        if (aliveResult.source === "unknown") {
+          if (now - updatedMs < unknownTimeout) {
+            skipped++;
+            continue;
+          }
+        } else if (aliveResult.alive) {
+          skipped++;
+          continue;
+        }
+        try {
+          await removeWorktree({
+            root: resolved,
+            worktree_path: entry.worktreePath,
+            force: true
+          });
+        } catch (err) {
+          failed.push({
+            worktreePath: entry.worktreePath,
+            error: `D 类 removeWorktree 失败: ${err instanceof Error ? err.message : String(err)}`
+          });
+          continue;
+        }
+        await deleteBranchIfExists({ root: resolved, branch: entry.branch }).catch(() => {});
+        entry.status = "discarded";
+        entry.updatedAt = new Date().toISOString();
+        const reasonSource = aliveResult.source === "unknown" ? `unknown-timeout (registry.updatedAt 已老于 ${unknownTimeout / 3600000}h)` : `opencode session ${aliveResult.source}: dead`;
+        cleaned.push({
+          sessionId: entry.sessionId,
+          worktreePath: entry.worktreePath,
+          reason: `D 类语义孤儿 (${reasonSource})`
+        });
+      }
+    });
+  }
+  const codeforgeWorktreeRoot = path11.resolve(path11.join(resolved, DEFAULT_WORKTREE_SUBDIR));
+  const fsWorktreePaths = [];
+  try {
+    const names = await fs9.readdir(codeforgeWorktreeRoot);
+    for (const name of names) {
+      fsWorktreePaths.push(path11.resolve(path11.join(codeforgeWorktreeRoot, name)));
+    }
+  } catch {}
+  const candidatePaths = new Set([
+    ...gitWorktreePaths,
+    ...fsWorktreePaths
+  ]);
+  const reg = await readRegistry(resolved);
+  const knownPaths = new Set(reg.entries.map((e) => path11.resolve(e.worktreePath)));
+  for (const candidate of candidatePaths) {
+    if (knownPaths.has(candidate))
+      continue;
+    if (candidate !== codeforgeWorktreeRoot && !candidate.startsWith(codeforgeWorktreeRoot + path11.sep)) {
+      continue;
+    }
+    let dirExists = true;
+    try {
+      const st = await fs9.stat(candidate);
+      if (Date.now() - st.mtimeMs < ORPHAN_GRACE_MS) {
+        skipped++;
+        continue;
+      }
+    } catch {
+      dirExists = false;
+    }
+    let removed = false;
+    let lastError = null;
+    try {
+      await removeWorktree({
+        root: resolved,
+        worktree_path: candidate,
+        force: true
+      });
+      removed = true;
+    } catch (err) {
+      lastError = err instanceof Error ? err.message : String(err);
+    }
+    if (removed) {
+      try {
+        await fs9.stat(candidate);
+        removed = false;
+        lastError = lastError ?? "git worktree remove 返回成功但目录仍存在（C 类 fs-only orphan）";
+      } catch {}
+    }
+    if (!removed && dirExists) {
+      try {
+        await fs9.rm(candidate, { recursive: true, force: true });
+        removed = true;
+      } catch (err) {
+        lastError = `git remove 失败: ${lastError}; fs.rm 也失败: ${err instanceof Error ? err.message : String(err)}`;
+      }
+    }
+    if (removed) {
+      const reason = gitWorktreePaths.has(candidate) ? "fs-only orphan (git 知道但 registry 无 entry)" : "fs-only orphan (git 不知道的纯 fs 残留)";
+      cleaned.push({ worktreePath: candidate, reason });
+    } else {
+      failed.push({ worktreePath: candidate, error: lastError ?? "unknown" });
+    }
+  }
+  let discardedPruned = 0;
+  try {
+    const r = await pruneDiscardedRegistryEntries(resolved);
+    discardedPruned = r.pruned;
+  } catch {}
+  let gitAdminPruned = 0;
+  try {
+    const out = await runGit2(resolved, ["worktree", "prune", "--verbose"]);
+    gitAdminPruned = out.split(`
+`).filter((l) => /\bRemoving\b/i.test(l)).length;
+  } catch {}
+  return { cleaned, failed, skipped, discardedPruned, gitAdminPruned };
+}
+
+// tools/review-approval.ts
+var description4 = [
+  "reviewer 专用：写入 APPROVE 审批记录。",
+  "**何时调用**：reviewer 给出 `## Decision\\nAPPROVE` 之前必须调本工具。",
+  "**两层语义独立**（ADR:decision-token-vs-approval-verdict-layering）：",
+  "  - 本工具 `verdict` 字段属审批层，合法值：APPROVE / APPROVE_WITH_NOTES",
+  "  - reviewer 输出的 `## Decision` 节首行属协议层，合法值：APPROVE / REQUEST_CHANGES / BLOCK",
+  "  - ⚠️ 严禁把 `APPROVE_WITH_NOTES` 字面量写进 `## Decision` 节首行（容错层会归一，但其他变体如 APPROVE_MINOR 会失败 → merge-loop 误判死循环）",
+  '  - ✅ 正确：verdict="APPROVE_WITH_NOTES" + `## Decision\\nAPPROVE`（首行写 APPROVE，详情在审批 notes）',
+  "**pendingIds 格式**：推荐 `session:<sid>` / `plan:<plan_id>` / `decision:<hash>`；旧 `pc-<ts>-NNN` 仍兼容。",
+  "**session:<sid> 自动补全**（ADR:review-approval-auto-covered-sha）：",
+  "  coveredSha 缺失时工具自动从 worktree HEAD 捕获（捕获失败 fail-closed → pre-check 安全 miss → 走完整 review）；",
+  "  reviewTarget 缺失时默认 'code'（[Session Merge Review] 流按合同即 code review）。",
+  "  显式传入的值优先，不覆盖。plan:/decision:/pc- id 不补全。",
+  "**何时不调**：REQUEST_CHANGES / BLOCK 不调（无 APPROVE = 无审批记录）。",
+  "**fallback**：codeforge 解析 reviewer boomerang 见 APPROVE 但无记录 → 自动以 source='codeforge-fallback' 补写。"
+].join(`
+`);
+var ArgsSchema4 = z4.object({
+  verdict: z4.enum(["APPROVE", "APPROVE_WITH_NOTES"]).describe("审批层裁决（审计字段，与协议层独立）；REQUEST_CHANGES / BLOCK 不应调本工具。⚠️ 不要把本字段值复制到 reviewer 输出的 `## Decision` 节首行 — 那是协议层 3 档。"),
+  pendingIds: z4.array(z4.string().min(1)).min(1, "pendingIds 至少 1 条").describe("本次 APPROVE 覆盖的 id 列表。推荐 session:<sid> / plan:<plan_id> / decision:<hash>；旧 pc-xxx 兼容"),
+  notes: z4.string().min(1, "notes 不能为空").max(2000, "notes 过长（> 2000 字），建议拆条").describe("审阅意见摘要（建议 ≤ 500 字）"),
+  decisionLine: z4.string().optional().describe("`## Decision` 节首行原文（默认 verdict 字面量，机审证据）"),
+  source: z4.enum(["reviewer", "codeforge-fallback"]).optional().describe("写入来源；默认 'reviewer'，codeforge 补写时传 'codeforge-fallback'"),
+  reviewerAgent: z4.string().optional().describe("写入 agent name（默认 'reviewer'；fallback 时为 'codeforge'）"),
+  sessionId: z4.string().optional().describe("reviewer 子 session id（boomerang 溯源用，可选）"),
+  model: z4.string().optional().describe("审批模型 id（审计用，可选）"),
+  coveredSha: z4.string().optional().describe("approval 写入时 worktree HEAD sha；对 session:<sid> id 工具会自动从 worktree HEAD 捕获（缺失时），显式传入值优先。ADR:review-approval-auto-covered-sha / ADR:merge-approval-pre-check"),
+  reviewTarget: z4.string().optional().describe("本次审阅的 review_target 值（reviewer.md 词表：code / code:typescript / code:python / code:csharp-lua-c / plan_only / adr / docs / decision_only）。对 session:<sid> id 缺失时默认 'code'，显式传入值优先。pre-check 仅放行 startsWith('code') 的值。ADR:review-approval-auto-covered-sha / ADR:merge-approval-pre-check")
+});
+var _approvalStore = null;
+function getApprovalStore() {
+  if (!_approvalStore)
+    _approvalStore = ApprovalStore.forProject(process.cwd());
+  return _approvalStore;
+}
+var _worktreeResolvers = { getSessionWorktree, getCurrentWorktreeHead };
+async function execute4(input) {
+  const parsed = ArgsSchema4.safeParse(input);
+  if (!parsed.success) {
     return {
       ok: false,
-      error: `agent[${name}].model invalid: "${String(o.model)}" (expect <provider>/<id>)`
+      error: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")
     };
   }
-  const fallbacks = normalizeFallbackList(`agent[${name}].fallback_models`, o.fallback_models);
-  if (!fallbacks.ok)
-    return { ok: false, error: fallbacks.error };
-  const thinking = o.thinking !== undefined ? normalizeThinking(`agent[${name}]`, o.thinking) : undefined;
-  if (thinking && !thinking.ok)
-    return { ok: false, error: thinking.error };
-  let tier;
-  if (o.tier !== undefined) {
-    if (typeof o.tier !== "string" || !isValidTierLevel(o.tier)) {
-      return {
-        ok: false,
-        error: `agent[${name}].tier="${String(o.tier)}" 不是合法 TierLevel (期望 ${TIER_ORDER.join("/")})`
-      };
+  const args = parsed.data;
+  const approvals = getApprovalStore();
+  const now = new Date().toISOString();
+  const written = [];
+  for (const id of args.pendingIds) {
+    let coveredSha = args.coveredSha;
+    let reviewTarget = args.reviewTarget;
+    const sessionMatch = /^session:(.+)$/.exec(id);
+    if (sessionMatch) {
+      const sid = sessionMatch[1];
+      if (!coveredSha) {
+        try {
+          const entry = await _worktreeResolvers.getSessionWorktree(sid, process.cwd());
+          if (entry?.worktreePath) {
+            const head = await _worktreeResolvers.getCurrentWorktreeHead(entry.worktreePath);
+            if (head)
+              coveredSha = head;
+          }
+        } catch {}
+      }
+      if (!reviewTarget)
+        reviewTarget = "code";
     }
-    tier = o.tier;
+    const meta = {
+      pendingId: id,
+      verdict: args.verdict,
+      reviewer: {
+        agent: args.reviewerAgent ?? (args.source === "codeforge-fallback" ? "codeforge" : "reviewer"),
+        ...args.sessionId ? { sessionId: args.sessionId } : {},
+        ...args.model ? { model: args.model } : {},
+        source: args.source ?? "reviewer"
+      },
+      targets: [],
+      decisionLine: args.decisionLine ?? args.verdict,
+      notes: args.notes,
+      createdAt: now,
+      ...coveredSha ? { coveredSha } : {},
+      ...reviewTarget ? { reviewTarget } : {},
+      escapeHatch: null
+    };
+    const file = await approvals.record(meta);
+    written.push({ pendingId: id, file });
   }
-  let tierOverrides;
-  if (o.tier_overrides !== undefined) {
-    const r = normalizeTierOverrides(name, o.tier_overrides);
-    if (!r.ok)
-      return { ok: false, error: r.error };
-    tierOverrides = r.value;
+  return { ok: true, written };
+}
+// tools/browser-navigate.ts
+import { z as z5 } from "zod";
+
+// lib/browser-control.ts
+import * as path12 from "node:path";
+var DEFAULT_CONFIG2 = {
+  enabled: false,
+  headless: true,
+  allow: ["^https?://"],
+  block: ["^file:", "^data:", "^about:", "^javascript:"],
+  actionTimeoutMs: 15000,
+  idleTimeoutMs: 5 * 60000,
+  screenshotDir: "",
+  bufferLimit: 500
+};
+function defaultScreenshotDir(root = process.cwd()) {
+  return path12.join(runtimeDir(root), "browser", "screenshots");
+}
+function checkUrl(url, cfg = DEFAULT_CONFIG2) {
+  if (typeof url !== "string" || url.trim() === "") {
+    return { ok: false, reason: "empty_url" };
+  }
+  for (const pat of cfg.block) {
+    try {
+      if (new RegExp(pat).test(url)) {
+        return { ok: false, reason: `blocked: matches ${pat}` };
+      }
+    } catch {}
+  }
+  if (cfg.allow.length === 0)
+    return { ok: true };
+  for (const pat of cfg.allow) {
+    try {
+      if (new RegExp(pat).test(url))
+        return { ok: true };
+    } catch {}
+  }
+  return { ok: false, reason: "not_in_allow_list" };
+}
+
+class NoopBrowserController {
+  reason;
+  constructor(reason = "browser is disabled (set tools.browser.enabled=true to use)") {
+    this.reason = reason;
+  }
+  async navigate(url) {
+    return { ok: false, url, error: this.reason };
+  }
+  async screenshot() {
+    return { ok: false, error: this.reason };
+  }
+  async click(selector) {
+    return { ok: false, selector, found: false, error: this.reason };
+  }
+  async fill(selector, _value) {
+    return { ok: false, selector, found: false, error: this.reason };
+  }
+  async consoleLogs() {
+    return [];
+  }
+  async networkRequests() {
+    return [];
+  }
+  async close() {}
+}
+async function tryCreatePlaywrightController(cfg = DEFAULT_CONFIG2, resolver = defaultPlaywrightResolver) {
+  if (!cfg.enabled)
+    return null;
+  let mod;
+  try {
+    mod = await resolver();
+  } catch {
+    return null;
   }
+  if (!mod || typeof mod !== "object")
+    return null;
+  const chromium = mod.chromium;
+  if (!chromium || typeof chromium.launch !== "function")
+    return null;
+  const browser = await chromium.launch({ headless: cfg.headless });
+  const context = await browser.newContext();
+  const page = await context.newPage();
+  const consoleBuf = [];
+  const networkBuf = [];
+  page.on?.("console", (...args) => {
+    const msg = args[0];
+    consoleBuf.push({
+      level: normalizeLevel(msg.type?.()),
+      text: msg.text?.() ?? "",
+      timestamp: Date.now()
+    });
+    if (consoleBuf.length > cfg.bufferLimit)
+      consoleBuf.splice(0, consoleBuf.length - cfg.bufferLimit);
+  });
+  page.on?.("request", (...args) => {
+    const req = args[0];
+    networkBuf.push({
+      url: req.url(),
+      method: req.method(),
+      start_ts: Date.now()
+    });
+    if (networkBuf.length > cfg.bufferLimit)
+      networkBuf.splice(0, networkBuf.length - cfg.bufferLimit);
+  });
+  page.on?.("response", (...args) => {
+    const res = args[0];
+    const item = networkBuf.find((n) => n.url === res.url() && n.end_ts === undefined);
+    if (item) {
+      item.status = res.status();
+      item.end_ts = Date.now();
+    }
+  });
+  page.on?.("requestfailed", (...args) => {
+    const req = args[0];
+    const item = networkBuf.find((n) => n.url === req.url() && n.end_ts === undefined);
+    if (item) {
+      item.failed = req.failure?.()?.errorText ?? "failed";
+      item.end_ts = Date.now();
+    }
+  });
   return {
-    ok: true,
-    binding: {
-      model: o.model,
-      variant: typeof o.variant === "string" ? o.variant : undefined,
-      category: typeof o.category === "string" ? o.category : undefined,
-      thinking: thinking?.value,
-      fallback_models: fallbacks.value,
-      tier,
-      tier_overrides: tierOverrides,
-      _doc: typeof o._doc === "string" ? o._doc : undefined
+    async navigate(url) {
+      const c = checkUrl(url, cfg);
+      if (!c.ok)
+        return { ok: false, url, error: c.reason };
+      const start = Date.now();
+      try {
+        const resp = await page.goto(url, { timeout: cfg.actionTimeoutMs });
+        return {
+          ok: true,
+          url,
+          status: resp?.status?.() ?? 200,
+          loaded_in_ms: Date.now() - start
+        };
+      } catch (err) {
+        return { ok: false, url, error: describe3(err) };
+      }
+    },
+    async screenshot(opts) {
+      try {
+        const dir = cfg.screenshotDir && cfg.screenshotDir.trim().length > 0 ? cfg.screenshotDir : defaultScreenshotDir();
+        const path13 = `${dir}/${Date.now()}.png`;
+        if (opts?.selector) {
+          const el = await page.locator(opts.selector).first();
+          await el.screenshot({ path: path13 });
+        } else {
+          await page.screenshot({ path: path13, fullPage: opts?.fullPage });
+        }
+        return { ok: true, path: path13 };
+      } catch (err) {
+        return { ok: false, error: describe3(err) };
+      }
+    },
+    async click(selector) {
+      try {
+        await page.locator(selector).first().click({ timeout: cfg.actionTimeoutMs });
+        return { ok: true, selector, found: true };
+      } catch (err) {
+        return { ok: false, selector, found: false, error: describe3(err) };
+      }
+    },
+    async fill(selector, value) {
+      try {
+        await page.locator(selector).first().fill(value, { timeout: cfg.actionTimeoutMs });
+        return { ok: true, selector, found: true };
+      } catch (err) {
+        return { ok: false, selector, found: false, error: describe3(err) };
+      }
+    },
+    async consoleLogs(opts = {}) {
+      return consoleBuf.filter((e) => (opts.sinceTs === undefined || e.timestamp >= opts.sinceTs) && (opts.level === undefined || e.level === opts.level));
+    },
+    async networkRequests(opts = {}) {
+      return networkBuf.filter((e) => (opts.sinceTs === undefined || e.start_ts >= opts.sinceTs) && (opts.method === undefined || e.method.toUpperCase() === opts.method.toUpperCase()));
+    },
+    async close() {
+      try {
+        await context.close();
+      } catch {}
+      try {
+        await browser.close();
+      } catch {}
     }
   };
 }
-function normalizeCategory(name, raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    return { ok: false, error: `category[${name}]: must be object` };
-  }
-  const o = raw;
-  if (typeof o.model !== "string" || !PROVIDER_MODEL_RE.test(o.model)) {
-    return {
-      ok: false,
-      error: `category[${name}].model invalid: "${String(o.model)}"`
-    };
-  }
-  const fallbacks = normalizeFallbackList(`category[${name}].fallback_models`, o.fallback_models);
-  if (!fallbacks.ok)
-    return { ok: false, error: fallbacks.error };
-  const thinking = o.thinking !== undefined ? normalizeThinking(`category[${name}]`, o.thinking) : undefined;
-  if (thinking && !thinking.ok)
-    return { ok: false, error: thinking.error };
-  return {
-    ok: true,
-    binding: {
-      model: o.model,
-      variant: typeof o.variant === "string" ? o.variant : undefined,
-      thinking: thinking?.value,
-      fallback_models: fallbacks.value,
-      _doc: typeof o._doc === "string" ? o._doc : undefined
-    }
-  };
+async function defaultPlaywrightResolver() {
+  return await import("playwright");
 }
-function normalizeFallbackList(ctx, raw) {
-  if (raw === undefined)
-    return { ok: true, value: [] };
-  if (!Array.isArray(raw))
-    return { ok: false, error: `${ctx}: must be array` };
-  const seen = new Set;
-  const result = [];
-  for (const it of raw) {
-    if (typeof it !== "string" || !PROVIDER_MODEL_RE.test(it)) {
-      return { ok: false, error: `${ctx}: invalid entry "${String(it)}"` };
-    }
-    if (seen.has(it))
-      continue;
-    seen.add(it);
-    result.push(it);
+function normalizeLevel(t) {
+  switch (t) {
+    case "info":
+    case "warn":
+    case "error":
+    case "debug":
+      return t;
+    default:
+      return "log";
   }
-  return { ok: true, value: result };
 }
-function normalizeThinking(ctx, raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    return { ok: false, error: `${ctx}.thinking: must be object` };
-  }
-  const o = raw;
-  if (o.type !== "enabled" && o.type !== "disabled") {
-    return { ok: false, error: `${ctx}.thinking.type: must be "enabled" or "disabled"` };
-  }
-  if (o.budget_tokens !== undefined && (typeof o.budget_tokens !== "number" || o.budget_tokens < 0)) {
-    return { ok: false, error: `${ctx}.thinking.budget_tokens: must be non-negative number` };
+function describe3(err) {
+  if (err instanceof Error)
+    return err.message;
+  if (typeof err === "string")
+    return err;
+  try {
+    return JSON.stringify(err);
+  } catch {
+    return String(err);
   }
-  return { ok: true, value: { ...o, type: o.type } };
 }
-function normalizeRuntime(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    return { ok: false, error: "runtime_fallback: must be object" };
-  }
-  const o = raw;
-  const cfg = { ...DEFAULT_RUNTIME_FALLBACK };
-  if (o.enabled !== undefined) {
-    if (typeof o.enabled !== "boolean")
-      return { ok: false, error: "runtime_fallback.enabled: boolean" };
-    cfg.enabled = o.enabled;
-  }
-  if (o.max_fallback_attempts !== undefined) {
-    if (typeof o.max_fallback_attempts !== "number" || o.max_fallback_attempts < 1) {
-      return { ok: false, error: "runtime_fallback.max_fallback_attempts: integer >=1" };
-    }
-    cfg.max_fallback_attempts = Math.floor(o.max_fallback_attempts);
-  }
-  if (o.notify_on_fallback !== undefined) {
-    if (typeof o.notify_on_fallback !== "boolean") {
-      return { ok: false, error: "runtime_fallback.notify_on_fallback: boolean" };
-    }
-    cfg.notify_on_fallback = o.notify_on_fallback;
+async function createBrowserController(opts = {}) {
+  const cfg = { ...DEFAULT_CONFIG2, ...opts.cfg };
+  if (!cfg.enabled) {
+    return new NoopBrowserController("browser disabled in config");
   }
-  if (o.trigger_events !== undefined) {
-    if (!Array.isArray(o.trigger_events) || o.trigger_events.some((x) => typeof x !== "string")) {
-      return { ok: false, error: "runtime_fallback.trigger_events: string[]" };
-    }
-    cfg.trigger_events = [...new Set(o.trigger_events)];
+  if (opts.factory) {
+    const c = await opts.factory(cfg);
+    if (c)
+      return c;
   }
-  if (typeof o._doc === "string")
-    cfg._doc = o._doc;
-  return { ok: true, cfg };
+  const playwright = await tryCreatePlaywrightController(cfg);
+  if (playwright)
+    return playwright;
+  return new NoopBrowserController("browser enabled but no driver available (npm i playwright 后重试)");
 }
-function isValidTierLevel(x) {
-  return typeof x === "string" && TIER_ORDER.includes(x);
+
+// tools/browser-navigate.ts
+var description5 = [
+  "打开指定 URL（受 tools.browser 配置控制；默认禁用）。",
+  "**何时调用**：需要看 web 页面真实渲染、调试前端、复现 bug 报告链接。",
+  "**注意**：仅允许 http/https；file:/data: 等协议被默认安全策略拒绝。"
+].join(`
+`);
+var ArgsSchema5 = z5.object({
+  url: z5.string().min(1).describe("要打开的 URL；必须是 http(s) 协议")
+});
+var _controller = null;
+var _cfg;
+async function getController() {
+  if (!_controller) {
+    _controller = await createBrowserController({ cfg: _cfg });
+  }
+  return _controller;
 }
-function normalizeTierOverrides(agentName, raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+async function execute5(input) {
+  const parsed = ArgsSchema5.safeParse(input);
+  if (!parsed.success) {
     return {
       ok: false,
-      error: `agent[${agentName}].tier_overrides 必须是 object（不是 array / null / 其他类型）`
+      url: typeof input?.url === "string" ? String(input.url) : "",
+      error: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")
     };
   }
-  const o = raw;
-  const result = {};
-  for (const [key, value] of Object.entries(o)) {
-    if (!isValidTierLevel(key)) {
-      return {
-        ok: false,
-        error: `agent[${agentName}].tier_overrides.${key}: 非法 TierLevel key (期望 ${TIER_ORDER.join("/")})`
-      };
-    }
-    if (!value || typeof value !== "object" || Array.isArray(value)) {
-      return {
-        ok: false,
-        error: `agent[${agentName}].tier_overrides.${key}: 必须是 object`
-      };
-    }
-    const ov = value;
-    const partial = {};
-    if (ov.level !== undefined) {
-      if (ov.level !== key) {
-        return {
-          ok: false,
-          error: `agent[${agentName}].tier_overrides.${key}.level="${String(ov.level)}" 与 key "${key}" 错配`
-        };
-      }
-      partial.level = key;
-    }
-    if (ov.model !== undefined) {
-      if (typeof ov.model !== "string" || !PROVIDER_MODEL_RE.test(ov.model)) {
-        return {
-          ok: false,
-          error: `agent[${agentName}].tier_overrides.${key}.model="${String(ov.model)}" 格式非法 (期望 <provider>/<id>)`
-        };
-      }
-      partial.model = ov.model;
-    }
-    if (ov.thinking !== undefined) {
-      const t = normalizeThinking(`agent[${agentName}].tier_overrides.${key}`, ov.thinking);
-      if (!t.ok)
-        return { ok: false, error: t.error };
-      partial.thinking = t.value;
-    }
-    if (ov.fallback_models !== undefined) {
-      const f = normalizeFallbackList(`agent[${agentName}].tier_overrides.${key}.fallback_models`, ov.fallback_models);
-      if (!f.ok)
-        return { ok: false, error: f.error };
-      partial.fallback_models = f.value;
-    }
-    result[key] = partial;
-  }
-  return { ok: true, value: result };
-}
-function normalizeTiers(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    return { ok: false, error: "models.tiers 必须是 object（不是 array / null）" };
-  }
-  const o = raw;
-  const cfg = {};
-  if (o.category_map !== undefined) {
-    if (!o.category_map || typeof o.category_map !== "object" || Array.isArray(o.category_map)) {
-      return { ok: false, error: "models.tiers.category_map 必须是 object" };
-    }
-    const map = {};
-    for (const [key, value] of Object.entries(o.category_map)) {
-      if (!isValidTierLevel(key)) {
-        return {
-          ok: false,
-          error: `models.tiers.category_map.${key}: 非法 TierLevel key (期望 ${TIER_ORDER.join("/")})`
-        };
-      }
-      if (typeof value !== "string" || value.length === 0) {
-        return {
-          ok: false,
-          error: `models.tiers.category_map.${key}: 必须是非空字符串（category 名）`
-        };
-      }
-      map[key] = value;
-    }
-    cfg.category_map = map;
-  }
-  if (typeof o._doc === "string")
-    cfg._doc = o._doc;
-  return { ok: true, cfg };
-}
-function resolveAgentModel(config, agent) {
-  const a = config.agents[agent];
-  if (!a)
-    return null;
-  const seen = new Set;
-  const chain = [];
-  const push = (m) => {
-    if (!m || seen.has(m))
-      return;
-    seen.add(m);
-    chain.push(m);
-  };
-  push(a.model);
-  for (const m of a.fallback_models ?? [])
-    push(m);
-  let categoryName;
-  let usedCategory = false;
-  if (a.category && config.categories?.[a.category]) {
-    categoryName = a.category;
-    const c = config.categories[a.category];
-    const beforeLen = chain.length;
-    push(c.model);
-    for (const m of c.fallback_models ?? [])
-      push(m);
-    usedCategory = chain.length > beforeLen;
+  try {
+    const ctrl = await getController();
+    return await ctrl.navigate(parsed.data.url);
+  } catch (err) {
+    return {
+      ok: false,
+      url: parsed.data.url,
+      error: err instanceof Error ? err.message : String(err)
+    };
   }
-  const source = a.fallback_models && a.fallback_models.length > 0 ? usedCategory ? "merged" : "agent" : usedCategory ? "category" : "agent";
-  return {
-    agent,
-    model: a.model,
-    variant: a.variant,
-    thinking: a.thinking,
-    chain,
-    source,
-    category: categoryName
-  };
 }
-function nextFallback(config, agent, current) {
-  const r = resolveAgentModel(config, agent);
-  if (!r)
-    return null;
-  const idx = r.chain.indexOf(current);
-  if (idx < 0)
-    return r.chain[0] ?? null;
-  return r.chain[idx + 1] ?? null;
+// tools/browser-click.ts
+import { z as z6 } from "zod";
+var description6 = [
+  "点击页面元素。属于「写操作」，semi 模式下应当让用户确认。",
+  "**何时调用**：表单提交、按钮触发、SPA 导航。",
+  "**避坑**：selector 优先用稳定属性（data-testid > role > 文本 > id），尽量不用 xpath。"
+].join(`
+`);
+var ArgsSchema6 = z6.object({
+  selector: z6.string().min(1).describe("CSS / Playwright locator 字符串，必须能唯一定位")
+});
+var _controller2 = null;
+var _cfg2;
+async function getController2() {
+  if (!_controller2) {
+    _controller2 = await createBrowserController({ cfg: _cfg2 });
+  }
+  return _controller2;
 }
-function listAllAgentChains(config) {
-  return Object.keys(config.agents).sort().map((name) => resolveAgentModel(config, name)).filter((x) => x !== null);
+async function execute6(input) {
+  const parsed = ArgsSchema6.safeParse(input);
+  if (!parsed.success) {
+    return {
+      ok: false,
+      selector: typeof input?.selector === "string" ? String(input.selector) : "",
+      found: false,
+      error: parsed.error.issues.map((i) => i.message).join("; ")
+    };
+  }
+  try {
+    const ctrl = await getController2();
+    return await ctrl.click(parsed.data.selector);
+  } catch (err) {
+    return {
+      ok: false,
+      selector: parsed.data.selector,
+      found: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
 }
-
-// tools/model-chain.ts
-var description11 = [
-  "查询 CodeForge 配置文件 codeforge.json：每个 agent 的主模型 + fallback 链。",
-  "**何时调用**：",
-  "- 用户问「coder 用什么模型 / 备用是什么」",
-  "- 当前模型不可用时，决定下一个该试哪个",
-  "- 审计：把整个项目的模型配置一次性列给用户看",
-  "返回 JSON：{ ok, agents: [...], current_chain?, next_fallback? }"
+// tools/browser-fill.ts
+import { z as z7 } from "zod";
+var description7 = [
+  "向 input/textarea/contenteditable 元素写入文本。",
+  "**何时调用**：登录表单、搜索框、富文本初始化。",
+  "**安全**：value 不会被自动 mask；不要把真实凭据塞进来。"
 ].join(`
 `);
-var ArgsSchema11 = z11.object({
-  agent: z11.string().optional().describe("查指定 agent；不传 → 列出全部"),
-  current: z11.string().optional().describe("当前已用过的模型（<provider>/<id>），用于算下一档"),
-  root: z11.string().optional().describe("项目根目录，默认 process.cwd()"),
-  config_file: z11.string().optional().describe("配置文件名；默认 codeforge.json")
+var ArgsSchema7 = z7.object({
+  selector: z7.string().min(1).describe("CSS / Playwright locator"),
+  value: z7.string().describe("要填入的文本；原样写入，不做转义")
 });
-async function execute11(rawArgs) {
-  const parsed = ArgsSchema11.safeParse(rawArgs ?? {});
+var _controller3 = null;
+var _cfg3;
+async function getController3() {
+  if (!_controller3) {
+    _controller3 = await createBrowserController({ cfg: _cfg3 });
+  }
+  return _controller3;
+}
+async function execute7(input) {
+  const parsed = ArgsSchema7.safeParse(input);
   if (!parsed.success) {
     return {
       ok: false,
-      error: "invalid_args: " + parsed.error.issues.map((i) => `${i.path.map(String).join(".")}: ${i.message}`).join("; ")
+      selector: typeof input?.selector === "string" ? String(input.selector) : "",
+      found: false,
+      error: parsed.error.issues.map((i) => i.message).join("; ")
     };
   }
-  const args = parsed.data;
-  const loadResult = await loadModelConfig({
-    root: args.root,
-    file: args.config_file
-  });
-  if (!loadResult.ok || !loadResult.config) {
+  try {
+    const ctrl = await getController3();
+    return await ctrl.fill(parsed.data.selector, parsed.data.value);
+  } catch (err) {
     return {
       ok: false,
-      error: loadResult.error ?? "load_failed",
-      config_path: loadResult.path
+      selector: parsed.data.selector,
+      found: false,
+      error: err instanceof Error ? err.message : String(err)
     };
   }
-  const cfg = loadResult.config;
-  const allChains = listAllAgentChains(cfg).map(toEntry);
-  const out = {
-    ok: true,
-    config_path: loadResult.path ?? "",
-    warnings: loadResult.warnings,
-    agents: allChains
-  };
-  if (args.agent) {
-    const r = resolveAgentModel(cfg, args.agent);
-    if (!r) {
-      return {
-        ok: false,
-        error: `agent_not_found: "${args.agent}" 未在 codeforge.json 配置`,
-        config_path: loadResult.path
-      };
-    }
-    out.current_chain = toEntry(r);
-    if (args.current) {
-      out.next_fallback = nextFallback(cfg, args.agent, args.current);
-    }
-  }
-  return out;
 }
-function toEntry(r) {
-  return {
-    agent: r.agent,
-    model: r.model,
-    category: r.category,
-    source: r.source,
-    chain: r.chain
-  };
+// tools/browser-screenshot.ts
+import { z as z8 } from "zod";
+var description8 = [
+  "截取当前页面（或指定元素）的屏幕快照。",
+  "**何时调用**：前端 dev 调试、回归对比、用户报 bug 没截图时让 agent 自取。",
+  "**注意**：必须先 navigate；输出路径写到 runtime 目录的 browser/screenshots/（XDG 全局位置，详见 lib/runtime-paths.ts）。"
+].join(`
+`);
+var ArgsSchema8 = z8.object({
+  fullPage: z8.boolean().optional().describe("是否截全长页面（默认仅可视区）"),
+  selector: z8.string().optional().describe("CSS 选择器；指定时只截该元素")
+});
+var _controller4 = null;
+var _cfg4;
+async function getController4() {
+  if (!_controller4) {
+    _controller4 = await createBrowserController({ cfg: _cfg4 });
+  }
+  return _controller4;
 }
-// tools/session-merge.ts
-import { z as z12 } from "zod";
-
-// lib/session-worktree.ts
-init_worktree_ops();
-import { execFile as execFile3 } from "node:child_process";
-import { promises as fs10 } from "node:fs";
-import * as path13 from "node:path";
-
-// lib/file-lock.ts
-import { promises as fs9 } from "node:fs";
-import * as crypto3 from "node:crypto";
-import * as os4 from "node:os";
-import * as path12 from "node:path";
-async function withFileLock(lockPath, fn, opts = {}) {
-  const retryMs = opts.retryMs ?? 50;
-  const timeoutMs = opts.timeoutMs ?? 1e4;
-  const staleMs = opts.staleMs ?? 300000;
-  await fs9.mkdir(path12.dirname(lockPath), { recursive: true });
-  const deadline = Date.now() + timeoutMs;
-  const myHost = os4.hostname();
-  const myToken = crypto3.randomBytes(16).toString("hex");
-  let acquired = false;
-  while (!acquired) {
-    try {
-      const handle = await fs9.open(lockPath, "wx");
-      try {
-        const meta = {
-          pid: process.pid,
-          host: myHost,
-          token: myToken,
-          acquired_at: new Date().toISOString()
-        };
-        await handle.writeFile(JSON.stringify(meta), "utf8");
-        await handle.close();
-      } catch (writeErr) {
-        await handle.close().catch(() => {});
-        await fs9.rm(lockPath, { force: true }).catch(() => {});
-        throw writeErr;
-      }
-      acquired = true;
-    } catch (err) {
-      const e = err;
-      if (e.code !== "EEXIST")
-        throw err;
-      const cleaned = await tryCleanStaleLock(lockPath, staleMs, myHost);
-      if (cleaned)
-        continue;
-      if (Date.now() >= deadline) {
-        throw new Error(`withFileLock: 等待 ${lockPath} 超过 ${timeoutMs}ms 仍未拿到锁`);
-      }
-      await sleep(retryMs);
-    }
+async function execute8(input) {
+  const parsed = ArgsSchema8.safeParse(input);
+  if (!parsed.success) {
+    return { ok: false, error: parsed.error.issues.map((i) => i.message).join("; ") };
   }
   try {
-    return await fn();
-  } finally {
-    await releaseLockSafely(lockPath, myToken).catch(() => {});
+    const ctrl = await getController4();
+    return await ctrl.screenshot(parsed.data);
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
   }
 }
-async function tryCleanStaleLock(lockPath, staleMs, myHost) {
-  let mtimeMs;
-  try {
-    const st = await fs9.stat(lockPath);
-    mtimeMs = st.mtimeMs;
-  } catch {
-    return true;
+// tools/browser-console.ts
+import { z as z9 } from "zod";
+var description9 = [
+  "读取浏览器控制台缓冲区（log/info/warn/error/debug）。",
+  "**何时调用**：调前端 bug、看页面 runtime error、跟 React/Vue 警告。",
+  "**注意**：缓冲区上限 500 条，超出会丢最早；只能读 navigate 之后的日志。"
+].join(`
+`);
+var ArgsSchema9 = z9.object({
+  level: z9.enum(["log", "info", "warn", "error", "debug"]).optional().describe("只过滤指定级别；缺省返回全部"),
+  sinceTs: z9.number().optional().describe("只返回 timestamp >= sinceTs 的条目")
+});
+var _controller5 = null;
+var _cfg5;
+async function getController5() {
+  if (!_controller5) {
+    _controller5 = await createBrowserController({ cfg: _cfg5 });
+  }
+  return _controller5;
+}
+async function execute9(input) {
+  const parsed = ArgsSchema9.safeParse(input);
+  if (!parsed.success) {
+    return {
+      ok: false,
+      entries: [],
+      error: parsed.error.issues.map((i) => i.message).join("; ")
+    };
   }
-  const age = Date.now() - mtimeMs;
-  if (age <= staleMs)
-    return false;
-  let meta = null;
   try {
-    const raw = await fs9.readFile(lockPath, "utf8");
-    meta = JSON.parse(raw);
-  } catch {
-    meta = null;
-  }
-  if (meta && meta.host === myHost && typeof meta.pid === "number" && meta.pid > 0) {
-    try {
-      process.kill(meta.pid, 0);
-      return false;
-    } catch (err) {
-      const e = err;
-      if (e.code === "EPERM")
-        return false;
-    }
+    const ctrl = await getController5();
+    const entries = await ctrl.consoleLogs(parsed.data);
+    return { ok: true, entries };
+  } catch (err) {
+    return {
+      ok: false,
+      entries: [],
+      error: err instanceof Error ? err.message : String(err)
+    };
   }
-  return await deleteIfMtimeMatch(lockPath, mtimeMs);
 }
-async function deleteIfMtimeMatch(lockPath, expectedMtimeMs) {
-  try {
-    const st = await fs9.stat(lockPath);
-    if (st.mtimeMs !== expectedMtimeMs) {
-      return false;
-    }
-  } catch {
-    return true;
+// tools/browser-network.ts
+import { z as z10 } from "zod";
+var description10 = [
+  "读取浏览器网络请求缓冲区（含 status / 失败原因 / 耗时）。",
+  "**何时调用**：调 API 调用 4xx/5xx、CORS 报错、查 page 加载耗时分布。",
+  "**注意**：缓冲区上限 500 条；只看 navigate 之后发起的请求。"
+].join(`
+`);
+var ArgsSchema10 = z10.object({
+  method: z10.string().optional().describe("HTTP 方法过滤（GET/POST/...），不区分大小写"),
+  sinceTs: z10.number().optional().describe("只返回 start_ts >= sinceTs 的请求")
+});
+var _controller6 = null;
+var _cfg6;
+async function getController6() {
+  if (!_controller6) {
+    _controller6 = await createBrowserController({ cfg: _cfg6 });
   }
-  await fs9.rm(lockPath, { force: true }).catch(() => {});
-  return true;
+  return _controller6;
 }
-async function releaseLockSafely(lockPath, myToken) {
-  let raw;
-  try {
-    raw = await fs9.readFile(lockPath, "utf8");
-  } catch {
-    return;
+async function execute10(input) {
+  const parsed = ArgsSchema10.safeParse(input);
+  if (!parsed.success) {
+    return {
+      ok: false,
+      entries: [],
+      error: parsed.error.issues.map((i) => i.message).join("; ")
+    };
   }
-  let meta;
   try {
-    meta = JSON.parse(raw);
-  } catch {
-    return;
-  }
-  if (meta.token === myToken) {
-    await fs9.rm(lockPath, { force: true });
+    const ctrl = await getController6();
+    const entries = await ctrl.networkRequests(parsed.data);
+    return { ok: true, entries };
+  } catch (err) {
+    return {
+      ok: false,
+      entries: [],
+      error: err instanceof Error ? err.message : String(err)
+    };
   }
 }
-function sleep(ms) {
-  return new Promise((resolve10) => setTimeout(resolve10, ms));
-}
+// tools/model-chain.ts
+import { z as z11 } from "zod";
 
-// lib/session-worktree.ts
-var REGISTRY_VERSION = 1;
-var DEFAULT_WORKTREE_SUBDIR = path13.join(".git", "codeforge-worktrees");
-function debugLog(msg) {
-  if (process.env["CODEFORGE_DEBUG"]) {
-    console.debug(`[session-worktree] ${msg}`);
-  }
-}
-function registryDir(mainRoot) {
-  return path13.join(runtimeDir(path13.resolve(mainRoot), { ensure: false }), "session-worktrees");
-}
-function registryPath(mainRoot) {
-  return path13.join(registryDir(mainRoot), "registry.json");
+// lib/model-config.ts
+import { promises as fs10 } from "node:fs";
+import * as path13 from "node:path";
+
+// lib/model-tier.ts
+var TIER_ORDER = ["quick", "balanced", "deep", "ultra"];
+
+// lib/model-config.ts
+var CONFIG_FILE = "codeforge.json";
+var DEFAULT_RUNTIME_FALLBACK = {
+  enabled: true,
+  max_fallback_attempts: 3,
+  notify_on_fallback: true,
+  trigger_events: ["session.error", "model.unavailable", "model.rate_limited"]
+};
+var PROVIDER_MODEL_RE = /^[a-z0-9-]+\/[a-zA-Z0-9._-]+$/;
+function findConfigFileSync(opts = {}) {
+  const root = opts.root ?? process.cwd();
+  const fsSync = __require("node:fs");
+  const abs = path13.resolve(root, opts.file ?? CONFIG_FILE);
+  return fsSync.existsSync(abs) ? abs : null;
 }
-function registryLockPath(mainRoot) {
-  return path13.join(registryDir(mainRoot), "registry.lock");
+function loadModelConfigSync(opts = {}) {
+  const root = opts.root ?? process.cwd();
+  const abs = path13.resolve(root, opts.file ?? CONFIG_FILE);
+  const fsSync = __require("node:fs");
+  if (!fsSync.existsSync(abs)) {
+    return { ok: false, warnings: [], error: `config_not_found: ${abs}` };
+  }
+  let raw;
+  try {
+    raw = fsSync.readFileSync(abs, "utf8");
+  } catch (e) {
+    return { ok: false, path: abs, warnings: [], error: `read_failed: ${e.message}` };
+  }
+  return parseAndValidate(raw, abs);
 }
-async function readRegistry(mainRoot) {
-  const file = registryPath(mainRoot);
+async function loadModelConfig(opts = {}) {
+  const root = opts.root ?? process.cwd();
+  const abs = path13.resolve(root, opts.file ?? CONFIG_FILE);
+  let raw;
   try {
-    const raw = await fs10.readFile(file, "utf8");
-    const parsed = JSON.parse(raw);
-    if (parsed.version !== REGISTRY_VERSION || !Array.isArray(parsed.entries)) {
-      return { version: REGISTRY_VERSION, entries: [] };
+    raw = await fs10.readFile(abs, "utf8");
+  } catch (e) {
+    const code = e.code;
+    if (code === "ENOENT") {
+      return { ok: false, path: abs, warnings: [], error: `config_not_found: ${abs}` };
     }
-    return parsed;
-  } catch (err) {
-    const e = err;
-    if (e.code === "ENOENT")
-      return { version: REGISTRY_VERSION, entries: [] };
-    return { version: REGISTRY_VERSION, entries: [] };
+    return { ok: false, path: abs, warnings: [], error: `read_failed: ${e.message}` };
   }
+  return parseAndValidate(raw, abs);
 }
-async function writeRegistry(mainRoot, reg) {
-  const file = registryPath(mainRoot);
-  await fs10.mkdir(path13.dirname(file), { recursive: true });
-  const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
-  await fs10.writeFile(tmp, JSON.stringify(reg, null, 2), "utf8");
-  await fs10.rename(tmp, file);
-}
-async function mutateRegistry(mainRoot, fn) {
-  const lockPath = registryLockPath(mainRoot);
-  await fs10.mkdir(path13.dirname(lockPath), { recursive: true });
-  return await withFileLock(lockPath, async () => {
-    const reg = await readRegistry(mainRoot);
-    const result = await fn(reg);
-    await writeRegistry(mainRoot, reg);
-    return result;
-  });
-}
-async function bindSessionWorktree(opts) {
-  if (!opts.sessionId || opts.sessionId.trim() === "") {
-    throw new Error("bindSessionWorktree: sessionId 不能为空");
+function parseAndValidate(raw, abs) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return { ok: false, path: abs, warnings: [], error: `invalid_json: ${e.message}` };
   }
-  const mainRoot = path13.resolve(opts.mainRoot);
-  const branch = opts.branchName ?? `codeforge/session-${opts.sessionId}`;
-  const worktreesDir = opts.worktrees_dir ?? path13.join(mainRoot, DEFAULT_WORKTREE_SUBDIR);
-  const lockPath = registryLockPath(mainRoot);
-  await fs10.mkdir(path13.dirname(lockPath), { recursive: true });
-  return await withFileLock(lockPath, async () => {
-    const reg = await readRegistry(mainRoot);
-    const existing = reg.entries.find((e) => e.sessionId === opts.sessionId);
-    if (existing && existing.status === "active")
-      return existing;
-    const baseSha = (await runGit2(mainRoot, ["rev-parse", "HEAD"])).trim();
-    const wt = await ensureWorktree({
-      root: mainRoot,
-      branch,
-      worktrees_dir: worktreesDir
-    });
-    const now = new Date().toISOString();
-    const entry = {
-      sessionId: opts.sessionId,
-      branch,
-      worktreePath: wt.path,
-      baseSha,
-      ...opts.requiredPlanId ? { requiredPlanId: opts.requiredPlanId, planReadOk: false } : {},
-      status: "active",
-      createdAt: now,
-      updatedAt: now
-    };
-    const idx = reg.entries.findIndex((e) => e.sessionId === opts.sessionId);
-    if (idx >= 0)
-      reg.entries[idx] = entry;
-    else
-      reg.entries.push(entry);
-    await writeRegistry(mainRoot, reg);
-    return entry;
-  });
-}
-async function getSessionWorktree(sessionId, mainRoot) {
-  const reg = await readRegistry(mainRoot);
-  return reg.entries.find((e) => e.sessionId === sessionId) ?? null;
-}
-async function markPlanReadOk(opts) {
-  return await mutateRegistry(opts.mainRoot, (reg) => {
-    const entry = reg.entries.find((e) => e.sessionId === opts.sessionId);
-    if (!entry || entry.requiredPlanId !== opts.planId)
-      return false;
-    entry.planReadOk = true;
-    entry.updatedAt = new Date().toISOString();
-    return true;
-  });
-}
-async function touchEntryUpdatedAt(opts) {
-  return await mutateRegistry(opts.mainRoot, (reg) => {
-    const entry = reg.entries.find((e) => e.sessionId === opts.sessionId);
-    if (!entry || entry.status !== "active")
-      return false;
-    entry.updatedAt = new Date().toISOString();
-    return true;
-  });
-}
-async function mergeSessionBack(opts) {
-  const mainRoot = path13.resolve(opts.mainRoot);
-  const entry = await getSessionWorktree(opts.sessionId, mainRoot);
-  if (!entry) {
-    throw new Error(`mergeSessionBack: session ${opts.sessionId} 没有绑定 worktree`);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { ok: false, path: abs, warnings: [], error: "invalid_root: must be an object" };
   }
-  if (entry.status === "interrupted_dirty") {
-    throw new Error(`mergeSessionBack: session ${opts.sessionId} 处于 interrupted_dirty 状态，` + `请先手动处理 worktree (${entry.worktreePath}) 后再 merge`);
+  const root = parsed;
+  const modelsNode = root.models;
+  if (!modelsNode || typeof modelsNode !== "object" || Array.isArray(modelsNode)) {
+    return { ok: false, path: abs, warnings: [], error: "missing_models: codeforge.json must have a top-level `models` object" };
   }
-  if (entry.status !== "active") {
-    throw new Error(`mergeSessionBack: session ${opts.sessionId} 状态为 ${entry.status}，无法 merge`);
+  const v = validateConfig(modelsNode);
+  if (!v.ok)
+    return { ok: false, path: abs, warnings: [], error: v.error };
+  return { ok: true, path: abs, config: v.config, warnings: v.warnings };
+}
+function validateConfig(input) {
+  const warnings = [];
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    return { ok: false, warnings, error: "config_root_must_be_object" };
   }
-  const wt = entry.worktreePath;
-  const branch = entry.branch;
-  const baseSha = entry.baseSha;
-  const wtStatus = (await runGit2(wt, ["status", "--porcelain"])).trim();
-  if (wtStatus.length > 0) {
-    await runGit2(wt, ["add", "-A"]);
-    await runGit2(wt, ["commit", "-m", `session(${opts.sessionId}): auto-commit before merge`]);
+  const obj = input;
+  const agentsRaw = obj.agents;
+  if (!agentsRaw || typeof agentsRaw !== "object" || Array.isArray(agentsRaw)) {
+    return { ok: false, warnings, error: "agents_required_object" };
   }
-  const mainStatus = (await runGit2(mainRoot, ["status", "--porcelain"])).trim();
-  if (mainStatus.length > 0) {
-    throw new Error(`mergeSessionBack: 主仓 ${mainRoot} 有未提交改动，请先 commit/stash 后再 merge`);
+  const agents = {};
+  for (const [name, value] of Object.entries(agentsRaw)) {
+    const r = normalizeAgent(name, value);
+    if (!r.ok)
+      return { ok: false, warnings, error: r.error };
+    agents[name] = r.binding;
   }
-  try {
-    await runGit2(mainRoot, ["merge", "--squash", branch]);
-  } catch (err) {
-    await runGit2(mainRoot, ["reset", "--merge"]).catch(() => {
-      return runGit2(mainRoot, ["reset", "--hard", "HEAD"]).catch(() => {});
-    });
-    throw new Error(`mergeSessionBack: squash merge 失败（已 reset 主仓兜底）: ${err.message}`);
+  if (Object.keys(agents).length === 0) {
+    return { ok: false, warnings, error: "agents_must_have_at_least_one_entry" };
   }
-  const buildScript = await getBuildScript(mainRoot);
-  if (buildScript) {
-    const stagedRaw = await runGit2(mainRoot, [
-      "diff",
-      "--cached",
-      "--name-only",
-      "--diff-filter=ACMR"
-    ]);
-    const stagedPaths = stagedRaw.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
-    const canSkipDevOnce = await shouldSkipDevOnce(mainRoot, stagedPaths, wt);
-    if (canSkipDevOnce) {} else {
-      try {
-        await runCmd("npm", ["run", buildScript], mainRoot);
-      } catch (err) {
-        await runGit2(mainRoot, ["reset", "--hard", "HEAD"]).catch(() => {});
-        const msg = err instanceof Error ? err.message : String(err);
-        throw new Error(`${buildScript} 失败已 reset 主仓: ${msg}`);
-      }
+  let categories;
+  if (obj.categories !== undefined) {
+    if (!obj.categories || typeof obj.categories !== "object" || Array.isArray(obj.categories)) {
+      return { ok: false, warnings, error: "categories_must_be_object" };
     }
-  } else {}
-  const squashedRaw = await runGit2(wt, ["log", "--format=%s", `${baseSha}..HEAD`]);
-  const squashedCommits = squashedRaw.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
-  const message = opts.commitMessage ?? buildMergeMessage(opts.sessionId, branch, baseSha, squashedCommits);
-  await runGitWithEnv(mainRoot, ["commit", "-m", message], {
-    SKIP_DEV_SYNC_CHECK: "1"
-  });
-  const newSha = (await runGit2(mainRoot, ["rev-parse", "HEAD"])).trim();
-  try {
-    await removeWorktree({ root: mainRoot, worktree_path: wt, force: true });
-  } catch (err) {
-    debugLog(`removeWorktree (merge) 非预期失败 (session=${opts.sessionId}): ${err.message}`);
-  }
-  await deleteBranchIfExists({ root: mainRoot, branch }).catch((err) => {
-    debugLog(`deleteBranchIfExists (merge) 非预期失败: ${err.message}`);
-    return { deleted: false };
-  });
-  await mutateRegistry(mainRoot, (reg) => {
-    const e = reg.entries.find((x) => x.sessionId === opts.sessionId);
-    if (e) {
-      e.status = "merged";
-      e.updatedAt = new Date().toISOString();
+    categories = {};
+    for (const [name, value] of Object.entries(obj.categories)) {
+      const r = normalizeCategory(name, value);
+      if (!r.ok)
+        return { ok: false, warnings, error: r.error };
+      categories[name] = r.binding;
     }
-  });
-  if (opts.planStore && entry.requiredPlanId) {
-    await opts.planStore.markMerged(entry.requiredPlanId, opts.sessionId).catch((err) => {
-      console.warn(`[session-worktree] planStore.markMerged(${entry.requiredPlanId}) 失败: ${err instanceof Error ? err.message : String(err)}`);
-    });
   }
-  return { sha: newSha, squashedCommits };
-}
-async function discardSession(opts) {
-  const mainRoot = path13.resolve(opts.mainRoot);
-  const entry = await getSessionWorktree(opts.sessionId, mainRoot);
-  if (!entry) {
-    return;
+  let runtime;
+  if (obj.runtime_fallback !== undefined) {
+    const r = normalizeRuntime(obj.runtime_fallback);
+    if (!r.ok)
+      return { ok: false, warnings, error: r.error };
+    runtime = r.cfg;
   }
-  if (entry.status === "merged" || entry.status === "discarded") {
-    return;
+  let tiers;
+  if (obj.tiers !== undefined) {
+    const r = normalizeTiers(obj.tiers);
+    if (!r.ok)
+      return { ok: false, warnings, error: r.error };
+    tiers = r.cfg;
   }
-  try {
-    await removeWorktree({
-      root: mainRoot,
-      worktree_path: entry.worktreePath,
-      force: true
-    });
-  } catch (err) {
-    debugLog(`removeWorktree (discard) 非预期失败: ${err.message}`);
+  for (const [name, agent] of Object.entries(agents)) {
+    if (agent.category && !categories?.[agent.category]) {
+      warnings.push(`agent[${name}].category="${agent.category}" 未在 categories 定义，将忽略 category 链`);
+    }
   }
-  await deleteBranchIfExists({ root: mainRoot, branch: entry.branch }).catch((err) => {
-    debugLog(`deleteBranchIfExists (discard) 非预期失败: ${err.message}`);
-    return { deleted: false };
-  });
-  await mutateRegistry(mainRoot, (reg) => {
-    const e = reg.entries.find((x) => x.sessionId === opts.sessionId);
-    if (e) {
-      e.status = "discarded";
-      e.updatedAt = new Date().toISOString();
+  for (const [name, agent] of Object.entries(agents)) {
+    if (!agent.tier)
+      continue;
+    const mappedCat = tiers?.category_map?.[agent.tier];
+    const hasOverride = agent.tier_overrides?.[agent.tier] !== undefined;
+    if (!mappedCat && !hasOverride) {
+      warnings.push(`agent[${name}].tier="${agent.tier}" 既无 models.tiers.category_map["${agent.tier}"] 映射，` + `也无 tier_overrides["${agent.tier}"]；该 agent 将不参与 tier 体系（adapter 返 null）。`);
+    } else if (mappedCat && !categories?.[mappedCat] && !hasOverride) {
+      warnings.push(`agent[${name}].tier="${agent.tier}" 通过 category_map 映射到 "${mappedCat}"，` + `但 categories.${mappedCat} 不存在；该 agent 将不参与 tier 体系。`);
     }
-  });
-  if (opts.planStore && entry.requiredPlanId) {
-    await opts.planStore.markDiscarded(entry.requiredPlanId, opts.sessionId).catch((err) => {
-      console.warn(`[session-worktree] planStore.markDiscarded(${entry.requiredPlanId}) 失败: ${err instanceof Error ? err.message : String(err)}`);
-    });
   }
-}
-async function markInterruptedDirty(opts) {
-  await mutateRegistry(opts.mainRoot, (reg) => {
-    const e = reg.entries.find((x) => x.sessionId === opts.sessionId);
-    if (e && e.status === "active") {
-      e.status = "interrupted_dirty";
-      e.updatedAt = new Date().toISOString();
+  return {
+    ok: true,
+    warnings,
+    config: {
+      $schema: typeof obj.$schema === "string" ? obj.$schema : undefined,
+      _doc: typeof obj._doc === "string" ? obj._doc : undefined,
+      agents,
+      categories,
+      runtime_fallback: runtime,
+      tiers
     }
-  });
+  };
 }
-async function getCurrentWorktreeHead(worktreePath) {
-  try {
-    return (await runGit2(path13.resolve(worktreePath), ["rev-parse", "HEAD"])).trim();
-  } catch {
-    return "";
+function normalizeAgent(name, raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return { ok: false, error: `agent[${name}]: must be object` };
   }
-}
-async function isWorktreeDirty(worktreePath) {
-  try {
-    const out = (await runGit2(worktreePath, ["status", "--porcelain"])).trim();
-    return out.length > 0;
-  } catch {
-    return false;
+  const o = raw;
+  if (typeof o.model !== "string" || !PROVIDER_MODEL_RE.test(o.model)) {
+    return {
+      ok: false,
+      error: `agent[${name}].model invalid: "${String(o.model)}" (expect <provider>/<id>)`
+    };
   }
-}
-async function checkpointCommit(opts) {
-  await runGit2(opts.worktreePath, ["add", "-A"]);
-  await runGit2(opts.worktreePath, ["commit", "-m", opts.message]);
-}
-function runGit2(cwd, args, timeoutMs = 1e4) {
-  return new Promise((resolve11, reject) => {
-    execFile3("git", args, { cwd, timeout: timeoutMs, windowsHide: true, encoding: "utf8" }, (err, stdout, stderr) => {
-      if (err) {
-        reject(new Error(`git ${args.join(" ")} (cwd=${cwd}) 失败: ${stderr?.trim() || err.message}`));
-        return;
-      }
-      resolve11(stdout);
-    });
-  });
-}
-function runGitWithEnv(cwd, args, envOverrides, timeoutMs = 1e4) {
-  const inheritedEnv = process["env"];
-  return new Promise((resolve11, reject) => {
-    execFile3("git", args, {
-      cwd,
-      timeout: timeoutMs,
-      windowsHide: true,
-      encoding: "utf8",
-      env: Object.assign({}, inheritedEnv, envOverrides)
-    }, (err, stdout, stderr) => {
-      if (err) {
-        reject(new Error(`git ${args.join(" ")} (cwd=${cwd}) 失败: ${stderr?.trim() || err.message}`));
-        return;
-      }
-      resolve11(stdout);
-    });
-  });
-}
-async function getBuildScript(mainRoot) {
-  const cfg = getCodeforgeConfig({ root: mainRoot });
-  const merge = cfg["merge"];
-  if (!merge || typeof merge !== "object" || Array.isArray(merge))
-    return null;
-  const script = merge["postMergeScript"];
-  if (typeof script !== "string")
-    return null;
-  const trimmed = script.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-async function shouldSkipDevOnce(mainRoot, stagedPaths, worktreePath) {
-  let distMtimeSec;
-  try {
-    const st = await fs10.stat(path13.join(mainRoot, "dist/index.js"));
-    distMtimeSec = Math.floor(st.mtimeMs / 1000);
-  } catch {
-    return false;
+  const fallbacks = normalizeFallbackList(`agent[${name}].fallback_models`, o.fallback_models);
+  if (!fallbacks.ok)
+    return { ok: false, error: fallbacks.error };
+  const thinking = o.thinking !== undefined ? normalizeThinking(`agent[${name}]`, o.thinking) : undefined;
+  if (thinking && !thinking.ok)
+    return { ok: false, error: thinking.error };
+  let tier;
+  if (o.tier !== undefined) {
+    if (typeof o.tier !== "string" || !isValidTierLevel(o.tier)) {
+      return {
+        ok: false,
+        error: `agent[${name}].tier="${String(o.tier)}" 不是合法 TierLevel (期望 ${TIER_ORDER.join("/")})`
+      };
+    }
+    tier = o.tier;
   }
-  const relevant = stagedPaths.filter((p) => /^(plugins|lib|src)\//.test(p) && !/\.(md|test\.ts)$/.test(p));
-  if (relevant.length === 0)
-    return true;
-  for (const rel of relevant) {
-    const srcMtimeSec = await statSourceMtime(rel, mainRoot, worktreePath);
-    if (srcMtimeSec === null)
-      return false;
-    if (srcMtimeSec > distMtimeSec)
-      return false;
+  let tierOverrides;
+  if (o.tier_overrides !== undefined) {
+    const r = normalizeTierOverrides(name, o.tier_overrides);
+    if (!r.ok)
+      return { ok: false, error: r.error };
+    tierOverrides = r.value;
   }
-  return true;
+  return {
+    ok: true,
+    binding: {
+      model: o.model,
+      variant: typeof o.variant === "string" ? o.variant : undefined,
+      category: typeof o.category === "string" ? o.category : undefined,
+      thinking: thinking?.value,
+      fallback_models: fallbacks.value,
+      tier,
+      tier_overrides: tierOverrides,
+      _doc: typeof o._doc === "string" ? o._doc : undefined
+    }
+  };
 }
-async function statSourceMtime(rel, mainRoot, worktreePath) {
-  if (worktreePath) {
-    try {
-      const st = await fs10.stat(path13.join(worktreePath, rel));
-      return Math.floor(st.mtimeMs / 1000);
-    } catch {}
+function normalizeCategory(name, raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return { ok: false, error: `category[${name}]: must be object` };
   }
-  try {
-    const st = await fs10.stat(path13.join(mainRoot, rel));
-    return Math.floor(st.mtimeMs / 1000);
-  } catch {
-    return null;
+  const o = raw;
+  if (typeof o.model !== "string" || !PROVIDER_MODEL_RE.test(o.model)) {
+    return {
+      ok: false,
+      error: `category[${name}].model invalid: "${String(o.model)}"`
+    };
   }
+  const fallbacks = normalizeFallbackList(`category[${name}].fallback_models`, o.fallback_models);
+  if (!fallbacks.ok)
+    return { ok: false, error: fallbacks.error };
+  const thinking = o.thinking !== undefined ? normalizeThinking(`category[${name}]`, o.thinking) : undefined;
+  if (thinking && !thinking.ok)
+    return { ok: false, error: thinking.error };
+  return {
+    ok: true,
+    binding: {
+      model: o.model,
+      variant: typeof o.variant === "string" ? o.variant : undefined,
+      thinking: thinking?.value,
+      fallback_models: fallbacks.value,
+      _doc: typeof o._doc === "string" ? o._doc : undefined
+    }
+  };
 }
-function runCmd(cmd, args, cwd, timeoutMs = 300000) {
-  return new Promise((resolve11, reject) => {
-    execFile3(cmd, args, { cwd, timeout: timeoutMs, windowsHide: true, encoding: "utf8" }, (err, stdout, stderr) => {
-      if (err) {
-        reject(new Error(`${cmd} ${args.join(" ")} (cwd=${cwd}) 失败: ${stderr?.trim() || err.message}`));
-        return;
-      }
-      resolve11(stdout);
-    });
-  });
+function normalizeFallbackList(ctx, raw) {
+  if (raw === undefined)
+    return { ok: true, value: [] };
+  if (!Array.isArray(raw))
+    return { ok: false, error: `${ctx}: must be array` };
+  const seen = new Set;
+  const result = [];
+  for (const it of raw) {
+    if (typeof it !== "string" || !PROVIDER_MODEL_RE.test(it)) {
+      return { ok: false, error: `${ctx}: invalid entry "${String(it)}"` };
+    }
+    if (seen.has(it))
+      continue;
+    seen.add(it);
+    result.push(it);
+  }
+  return { ok: true, value: result };
 }
-function buildMergeMessage(sessionId, branch, baseSha, squashed) {
-  const subject = `session(${sessionId}): merge ${branch}`;
-  const body = squashed.length > 0 ? `
-
-Squashed commits:
-${squashed.map((s) => `  - ${s}`).join(`
-`)}` : "";
-  const footer = `
-
-Codeforge-Session: ${sessionId}
-Codeforge-Base: ${baseSha.slice(0, 12)}`;
-  return subject + body + footer;
+function normalizeThinking(ctx, raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return { ok: false, error: `${ctx}.thinking: must be object` };
+  }
+  const o = raw;
+  if (o.type !== "enabled" && o.type !== "disabled") {
+    return { ok: false, error: `${ctx}.thinking.type: must be "enabled" or "disabled"` };
+  }
+  if (o.budget_tokens !== undefined && (typeof o.budget_tokens !== "number" || o.budget_tokens < 0)) {
+    return { ok: false, error: `${ctx}.thinking.budget_tokens: must be non-negative number` };
+  }
+  return { ok: true, value: { ...o, type: o.type } };
 }
-var ORPHAN_GRACE_MS = 60000;
-var SEMANTIC_ORPHAN_MIN_AGE_MS = 6 * 60 * 60000;
-var SEMANTIC_ORPHAN_UNKNOWN_TIMEOUT_MS = 72 * 60 * 60000;
-async function pruneDiscardedRegistryEntries(mainRoot, opts = {}) {
-  const keepRecent = opts.keepRecent ?? 50;
-  if (keepRecent < 0) {
-    throw new Error(`pruneDiscardedRegistryEntries: keepRecent 必须 ≥ 0，收到 ${keepRecent}`);
+function normalizeRuntime(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return { ok: false, error: "runtime_fallback: must be object" };
   }
-  return await mutateRegistry(path13.resolve(mainRoot), (reg) => {
-    const discarded = [];
-    const others = [];
-    for (const e of reg.entries) {
-      if (e.status === "discarded")
-        discarded.push(e);
-      else
-        others.push(e);
+  const o = raw;
+  const cfg = { ...DEFAULT_RUNTIME_FALLBACK };
+  if (o.enabled !== undefined) {
+    if (typeof o.enabled !== "boolean")
+      return { ok: false, error: "runtime_fallback.enabled: boolean" };
+    cfg.enabled = o.enabled;
+  }
+  if (o.max_fallback_attempts !== undefined) {
+    if (typeof o.max_fallback_attempts !== "number" || o.max_fallback_attempts < 1) {
+      return { ok: false, error: "runtime_fallback.max_fallback_attempts: integer >=1" };
     }
-    discarded.sort((a, b) => a.updatedAt < b.updatedAt ? 1 : a.updatedAt > b.updatedAt ? -1 : 0);
-    const kept = discarded.slice(0, keepRecent);
-    const pruned = discarded.length - kept.length;
-    reg.entries = [...others, ...kept];
-    return { pruned, kept: kept.length };
-  });
-}
-async function pruneOrphanWorktrees(mainRoot, opts = {}) {
-  const resolved = path13.resolve(mainRoot);
-  const cleaned = [];
-  const failed = [];
-  let skipped = 0;
-  let gitWorktrees = [];
-  try {
-    const mod = await Promise.resolve().then(() => (init_worktree_ops(), exports_worktree_ops));
-    gitWorktrees = await mod.listWorktrees({ root: resolved });
-  } catch {
-    gitWorktrees = [];
+    cfg.max_fallback_attempts = Math.floor(o.max_fallback_attempts);
   }
-  const gitWorktreePaths = new Set(gitWorktrees.map((w) => path13.resolve(w.path)));
-  await mutateRegistry(resolved, async (reg2) => {
-    const now = Date.now();
-    for (const entry of reg2.entries) {
-      if (entry.status !== "active")
-        continue;
-      const wt = entry.worktreePath;
-      let dirExists = true;
-      let dirMtimeMs = 0;
-      try {
-        const st = await fs10.stat(wt);
-        dirExists = st.isDirectory();
-        dirMtimeMs = st.mtimeMs;
-      } catch {
-        dirExists = false;
-      }
-      if (dirExists && now - dirMtimeMs < ORPHAN_GRACE_MS) {
-        skipped++;
-        continue;
-      }
-      let branchExists = true;
-      try {
-        await runGit2(resolved, ["rev-parse", "--verify", `refs/heads/${entry.branch}`]);
-      } catch {
-        branchExists = false;
-      }
-      if (!dirExists || !branchExists) {
-        const reason = !dirExists ? "worktreePath 不存在" : "branch 不存在";
-        entry.status = "discarded";
-        entry.updatedAt = new Date().toISOString();
-        if (dirExists) {
-          try {
-            await removeWorktree({
-              root: resolved,
-              worktree_path: wt,
-              force: true
-            });
-          } catch (err) {
-            failed.push({
-              worktreePath: wt,
-              error: err instanceof Error ? err.message : String(err)
-            });
-          }
-        }
-        cleaned.push({ sessionId: entry.sessionId, worktreePath: wt, reason });
-      }
+  if (o.notify_on_fallback !== undefined) {
+    if (typeof o.notify_on_fallback !== "boolean") {
+      return { ok: false, error: "runtime_fallback.notify_on_fallback: boolean" };
     }
-  });
-  if (opts.isSessionAlive) {
-    const minAge = opts.semanticOrphanMinAgeMs ?? SEMANTIC_ORPHAN_MIN_AGE_MS;
-    const unknownTimeout = opts.semanticOrphanUnknownTimeoutMs ?? SEMANTIC_ORPHAN_UNKNOWN_TIMEOUT_MS;
-    const probe = opts.isSessionAlive;
-    await mutateRegistry(resolved, async (reg2) => {
-      const now = Date.now();
-      for (const entry of reg2.entries) {
-        if (entry.status !== "active")
-          continue;
-        const updatedMs = Date.parse(entry.updatedAt);
-        if (!Number.isFinite(updatedMs) || now - updatedMs < minAge) {
-          skipped++;
-          continue;
-        }
-        let aliveResult;
-        try {
-          aliveResult = await probe(entry.sessionId);
-        } catch {
-          skipped++;
-          continue;
-        }
-        if (aliveResult.source === "unknown") {
-          if (now - updatedMs < unknownTimeout) {
-            skipped++;
-            continue;
-          }
-        } else if (aliveResult.alive) {
-          skipped++;
-          continue;
-        }
-        try {
-          await removeWorktree({
-            root: resolved,
-            worktree_path: entry.worktreePath,
-            force: true
-          });
-        } catch (err) {
-          failed.push({
-            worktreePath: entry.worktreePath,
-            error: `D 类 removeWorktree 失败: ${err instanceof Error ? err.message : String(err)}`
-          });
-          continue;
-        }
-        await deleteBranchIfExists({ root: resolved, branch: entry.branch }).catch(() => {});
-        entry.status = "discarded";
-        entry.updatedAt = new Date().toISOString();
-        const reasonSource = aliveResult.source === "unknown" ? `unknown-timeout (registry.updatedAt 已老于 ${unknownTimeout / 3600000}h)` : `opencode session ${aliveResult.source}: dead`;
-        cleaned.push({
-          sessionId: entry.sessionId,
-          worktreePath: entry.worktreePath,
-          reason: `D 类语义孤儿 (${reasonSource})`
-        });
-      }
-    });
+    cfg.notify_on_fallback = o.notify_on_fallback;
+  }
+  if (o.trigger_events !== undefined) {
+    if (!Array.isArray(o.trigger_events) || o.trigger_events.some((x) => typeof x !== "string")) {
+      return { ok: false, error: "runtime_fallback.trigger_events: string[]" };
+    }
+    cfg.trigger_events = [...new Set(o.trigger_events)];
+  }
+  if (typeof o._doc === "string")
+    cfg._doc = o._doc;
+  return { ok: true, cfg };
+}
+function isValidTierLevel(x) {
+  return typeof x === "string" && TIER_ORDER.includes(x);
+}
+function normalizeTierOverrides(agentName, raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return {
+      ok: false,
+      error: `agent[${agentName}].tier_overrides 必须是 object（不是 array / null / 其他类型）`
+    };
   }
-  const codeforgeWorktreeRoot = path13.resolve(path13.join(resolved, DEFAULT_WORKTREE_SUBDIR));
-  const fsWorktreePaths = [];
-  try {
-    const names = await fs10.readdir(codeforgeWorktreeRoot);
-    for (const name of names) {
-      fsWorktreePaths.push(path13.resolve(path13.join(codeforgeWorktreeRoot, name)));
+  const o = raw;
+  const result = {};
+  for (const [key, value] of Object.entries(o)) {
+    if (!isValidTierLevel(key)) {
+      return {
+        ok: false,
+        error: `agent[${agentName}].tier_overrides.${key}: 非法 TierLevel key (期望 ${TIER_ORDER.join("/")})`
+      };
     }
-  } catch {}
-  const candidatePaths = new Set([
-    ...gitWorktreePaths,
-    ...fsWorktreePaths
-  ]);
-  const reg = await readRegistry(resolved);
-  const knownPaths = new Set(reg.entries.map((e) => path13.resolve(e.worktreePath)));
-  for (const candidate of candidatePaths) {
-    if (knownPaths.has(candidate))
-      continue;
-    if (candidate !== codeforgeWorktreeRoot && !candidate.startsWith(codeforgeWorktreeRoot + path13.sep)) {
-      continue;
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      return {
+        ok: false,
+        error: `agent[${agentName}].tier_overrides.${key}: 必须是 object`
+      };
     }
-    let dirExists = true;
-    try {
-      const st = await fs10.stat(candidate);
-      if (Date.now() - st.mtimeMs < ORPHAN_GRACE_MS) {
-        skipped++;
-        continue;
+    const ov = value;
+    const partial = {};
+    if (ov.level !== undefined) {
+      if (ov.level !== key) {
+        return {
+          ok: false,
+          error: `agent[${agentName}].tier_overrides.${key}.level="${String(ov.level)}" 与 key "${key}" 错配`
+        };
       }
-    } catch {
-      dirExists = false;
+      partial.level = key;
     }
-    let removed = false;
-    let lastError = null;
-    try {
-      await removeWorktree({
-        root: resolved,
-        worktree_path: candidate,
-        force: true
-      });
-      removed = true;
-    } catch (err) {
-      lastError = err instanceof Error ? err.message : String(err);
+    if (ov.model !== undefined) {
+      if (typeof ov.model !== "string" || !PROVIDER_MODEL_RE.test(ov.model)) {
+        return {
+          ok: false,
+          error: `agent[${agentName}].tier_overrides.${key}.model="${String(ov.model)}" 格式非法 (期望 <provider>/<id>)`
+        };
+      }
+      partial.model = ov.model;
     }
-    if (removed) {
-      try {
-        await fs10.stat(candidate);
-        removed = false;
-        lastError = lastError ?? "git worktree remove 返回成功但目录仍存在（C 类 fs-only orphan）";
-      } catch {}
+    if (ov.thinking !== undefined) {
+      const t = normalizeThinking(`agent[${agentName}].tier_overrides.${key}`, ov.thinking);
+      if (!t.ok)
+        return { ok: false, error: t.error };
+      partial.thinking = t.value;
     }
-    if (!removed && dirExists) {
-      try {
-        await fs10.rm(candidate, { recursive: true, force: true });
-        removed = true;
-      } catch (err) {
-        lastError = `git remove 失败: ${lastError}; fs.rm 也失败: ${err instanceof Error ? err.message : String(err)}`;
+    if (ov.fallback_models !== undefined) {
+      const f = normalizeFallbackList(`agent[${agentName}].tier_overrides.${key}.fallback_models`, ov.fallback_models);
+      if (!f.ok)
+        return { ok: false, error: f.error };
+      partial.fallback_models = f.value;
+    }
+    result[key] = partial;
+  }
+  return { ok: true, value: result };
+}
+function normalizeTiers(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return { ok: false, error: "models.tiers 必须是 object（不是 array / null）" };
+  }
+  const o = raw;
+  const cfg = {};
+  if (o.category_map !== undefined) {
+    if (!o.category_map || typeof o.category_map !== "object" || Array.isArray(o.category_map)) {
+      return { ok: false, error: "models.tiers.category_map 必须是 object" };
+    }
+    const map = {};
+    for (const [key, value] of Object.entries(o.category_map)) {
+      if (!isValidTierLevel(key)) {
+        return {
+          ok: false,
+          error: `models.tiers.category_map.${key}: 非法 TierLevel key (期望 ${TIER_ORDER.join("/")})`
+        };
+      }
+      if (typeof value !== "string" || value.length === 0) {
+        return {
+          ok: false,
+          error: `models.tiers.category_map.${key}: 必须是非空字符串（category 名）`
+        };
       }
+      map[key] = value;
     }
-    if (removed) {
-      const reason = gitWorktreePaths.has(candidate) ? "fs-only orphan (git 知道但 registry 无 entry)" : "fs-only orphan (git 不知道的纯 fs 残留)";
-      cleaned.push({ worktreePath: candidate, reason });
-    } else {
-      failed.push({ worktreePath: candidate, error: lastError ?? "unknown" });
+    cfg.category_map = map;
+  }
+  if (typeof o._doc === "string")
+    cfg._doc = o._doc;
+  return { ok: true, cfg };
+}
+function resolveAgentModel(config, agent) {
+  const a = config.agents[agent];
+  if (!a)
+    return null;
+  const seen = new Set;
+  const chain = [];
+  const push = (m) => {
+    if (!m || seen.has(m))
+      return;
+    seen.add(m);
+    chain.push(m);
+  };
+  push(a.model);
+  for (const m of a.fallback_models ?? [])
+    push(m);
+  let categoryName;
+  let usedCategory = false;
+  if (a.category && config.categories?.[a.category]) {
+    categoryName = a.category;
+    const c = config.categories[a.category];
+    const beforeLen = chain.length;
+    push(c.model);
+    for (const m of c.fallback_models ?? [])
+      push(m);
+    usedCategory = chain.length > beforeLen;
+  }
+  const source = a.fallback_models && a.fallback_models.length > 0 ? usedCategory ? "merged" : "agent" : usedCategory ? "category" : "agent";
+  return {
+    agent,
+    model: a.model,
+    variant: a.variant,
+    thinking: a.thinking,
+    chain,
+    source,
+    category: categoryName
+  };
+}
+function nextFallback(config, agent, current) {
+  const r = resolveAgentModel(config, agent);
+  if (!r)
+    return null;
+  const idx = r.chain.indexOf(current);
+  if (idx < 0)
+    return r.chain[0] ?? null;
+  return r.chain[idx + 1] ?? null;
+}
+function listAllAgentChains(config) {
+  return Object.keys(config.agents).sort().map((name) => resolveAgentModel(config, name)).filter((x) => x !== null);
+}
+
+// tools/model-chain.ts
+var description11 = [
+  "查询 CodeForge 配置文件 codeforge.json：每个 agent 的主模型 + fallback 链。",
+  "**何时调用**：",
+  "- 用户问「coder 用什么模型 / 备用是什么」",
+  "- 当前模型不可用时，决定下一个该试哪个",
+  "- 审计：把整个项目的模型配置一次性列给用户看",
+  "返回 JSON：{ ok, agents: [...], current_chain?, next_fallback? }"
+].join(`
+`);
+var ArgsSchema11 = z11.object({
+  agent: z11.string().optional().describe("查指定 agent；不传 → 列出全部"),
+  current: z11.string().optional().describe("当前已用过的模型（<provider>/<id>），用于算下一档"),
+  root: z11.string().optional().describe("项目根目录，默认 process.cwd()"),
+  config_file: z11.string().optional().describe("配置文件名；默认 codeforge.json")
+});
+async function execute11(rawArgs) {
+  const parsed = ArgsSchema11.safeParse(rawArgs ?? {});
+  if (!parsed.success) {
+    return {
+      ok: false,
+      error: "invalid_args: " + parsed.error.issues.map((i) => `${i.path.map(String).join(".")}: ${i.message}`).join("; ")
+    };
+  }
+  const args = parsed.data;
+  const loadResult = await loadModelConfig({
+    root: args.root,
+    file: args.config_file
+  });
+  if (!loadResult.ok || !loadResult.config) {
+    return {
+      ok: false,
+      error: loadResult.error ?? "load_failed",
+      config_path: loadResult.path
+    };
+  }
+  const cfg = loadResult.config;
+  const allChains = listAllAgentChains(cfg).map(toEntry);
+  const out = {
+    ok: true,
+    config_path: loadResult.path ?? "",
+    warnings: loadResult.warnings,
+    agents: allChains
+  };
+  if (args.agent) {
+    const r = resolveAgentModel(cfg, args.agent);
+    if (!r) {
+      return {
+        ok: false,
+        error: `agent_not_found: "${args.agent}" 未在 codeforge.json 配置`,
+        config_path: loadResult.path
+      };
+    }
+    out.current_chain = toEntry(r);
+    if (args.current) {
+      out.next_fallback = nextFallback(cfg, args.agent, args.current);
     }
   }
-  let discardedPruned = 0;
-  try {
-    const r = await pruneDiscardedRegistryEntries(resolved);
-    discardedPruned = r.pruned;
-  } catch {}
-  let gitAdminPruned = 0;
-  try {
-    const out = await runGit2(resolved, ["worktree", "prune", "--verbose"]);
-    gitAdminPruned = out.split(`
-`).filter((l) => /\bRemoving\b/i.test(l)).length;
-  } catch {}
-  return { cleaned, failed, skipped, discardedPruned, gitAdminPruned };
+  return out;
+}
+function toEntry(r) {
+  return {
+    agent: r.agent,
+    model: r.model,
+    category: r.category,
+    source: r.source,
+    chain: r.chain
+  };
 }
+// tools/session-merge.ts
+import { z as z12 } from "zod";
 
 // lib/merge-gate.ts
 import { promises as fs11 } from "node:fs";
@@ -14545,7 +14568,7 @@ function buildReviewerPrompt(args) {
   ];
   if (args.planId)
     lines.push(`plan_id: ${args.planId}`);
-  lines.push(`round: ${args.round}/${args.maxRounds}`, "", "请按 reviewer.md 「worktree-session 审阅」模式执行：", "1. 若有 plan_id → 先 plan_read(plan_id=...) 拿方案", "2. 跑 `git -C <worktree_path> diff <base_sha>..HEAD` 看改动", '3. APPROVE 前必须先调 review_approval(verdict=APPROVE, pendingIds=["session:<session_id>"]) 写审批', "4. 输出 ## Decision 节，首行 APPROVE / REQUEST_CHANGES / BLOCK 之一");
+  lines.push(`round: ${args.round}/${args.maxRounds}`, "", "请按 reviewer.md 「worktree-session 审阅」模式执行：", "1. 若有 plan_id → 先 plan_read(plan_id=...) 拿方案", "2. 跑 `git -C <worktree_path> diff <base_sha>..HEAD` 看改动", '3. APPROVE 前必须先调 review_approval(verdict=APPROVE, pendingIds=["session:<session_id>"], reviewTarget="code") 写审批', "   （coveredSha 工具会自动从 worktree HEAD 捕获，无需手传）", "4. 输出 ## Decision 节，首行 APPROVE / REQUEST_CHANGES / BLOCK 之一");
   if (args.prevSummary) {
     lines.push("", "## 上一轮 reviewer 意见", "", args.prevSummary, "", "请确认 coder 是否已按意见修复");
   }
@@ -20143,35 +20166,21 @@ var toolPolicyServer = async (ctx) => {
 var handler19 = toolPolicyServer;
 
 // plugins/update-checker.ts
-import { existsSync as existsSync6, rmSync } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { join as join25 } from "node:path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { dirname as dirname15, join as join25 } from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
 
 // lib/update-checker-impl.ts
-import { createHash as createHash4 } from "node:crypto";
-import {
-  copyFileSync,
-  existsSync as existsSync5,
-  mkdirSync as mkdirSync3,
-  mkdtempSync,
-  readFileSync as readFileSync5,
-  readdirSync as readdirSync3,
-  renameSync,
-  statSync as statSync4,
-  unlinkSync,
-  writeFileSync as writeFileSync2
-} from "node:fs";
-import { homedir as homedir8, tmpdir } from "node:os";
+import { readFileSync as readFileSync5 } from "node:fs";
 import { dirname as dirname14, join as join24 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import * as https from "node:https";
-import * as zlib from "node:zlib";
 
 // lib/version-injected.ts
 function getInjectedVersion() {
   try {
-    const v = "0.6.12";
+    const v = "0.7.0";
     if (typeof v === "string" && /^\d+\.\d+\.\d+/.test(v)) {
       return v;
     }
@@ -20182,48 +20191,6 @@ function getInjectedVersion() {
 }
 
 // lib/update-checker-impl.ts
-async function checkUpdateOnce(opts) {
-  const local = opts.localVersion ?? readLocalVersion();
-  const cacheFile = opts.cacheFile ?? defaultCacheFile();
-  const now = (opts.now ?? Date.now)();
-  if (!opts.forceFresh) {
-    const cached = readCache(cacheFile);
-    if (cached && cached.repo === opts.repo && now - cached.checkedAt < opts.intervalMs) {
-      return {
-        hasUpdate: cmpVersion(local, cached.remote) < 0,
-        local,
-        remote: cached.remote,
-        fromCache: true,
-        cacheAgeMs: now - cached.checkedAt
-      };
-    }
-  }
-  const fetcher = opts.fetcher ?? fetchLatestTagFromGitHub;
-  let remote = null;
-  let fetchErr;
-  try {
-    remote = await fetcher(opts.repo);
-  } catch (e) {
-    fetchErr = e instanceof Error ? e.message : String(e);
-  }
-  if (remote === null) {
-    writeCache(cacheFile, { checkedAt: now, remote: local, repo: opts.repo });
-    return {
-      hasUpdate: false,
-      local,
-      remote: "(no release)",
-      fromCache: false,
-      error: fetchErr ?? "no_release"
-    };
-  }
-  writeCache(cacheFile, { checkedAt: now, remote, repo: opts.repo });
-  return {
-    hasUpdate: cmpVersion(local, remote) < 0,
-    local,
-    remote,
-    fromCache: false
-  };
-}
 function cmpVersion(a, b) {
   const pa = parseSemver(a);
   const pb = parseSemver(b);
@@ -20267,97 +20234,6 @@ function readLocalVersion() {
     return "0.0.0";
   }
 }
-function defaultCacheDir() {
-  return process.env["CODEFORGE_CACHE_DIR"] ?? join24(homedir8(), ".cache", "codeforge");
-}
-function defaultCacheFile() {
-  return join24(defaultCacheDir(), "update-check.json");
-}
-function readCache(file) {
-  try {
-    if (!existsSync5(file))
-      return null;
-    const raw = readFileSync5(file, "utf8");
-    const obj = JSON.parse(raw);
-    if (obj && typeof obj === "object" && typeof obj.checkedAt === "number" && typeof obj.remote === "string" && typeof obj.repo === "string") {
-      return obj;
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-function writeCache(file, entry) {
-  try {
-    mkdirSync3(dirname14(file), { recursive: true });
-    writeFileSync2(file, JSON.stringify(entry, null, 2), "utf8");
-  } catch {}
-}
-var GITHUB_API_HOST = "api.github.com";
-var MAX_REDIRECTS = 5;
-function fetchLatestTagFromGitHub(repo) {
-  return getJsonWithRedirect(`https://${GITHUB_API_HOST}/repos/${repo}/releases/latest`, MAX_REDIRECTS).then((body) => {
-    if (body === null)
-      return null;
-    try {
-      const json = JSON.parse(body);
-      return typeof json.tag_name === "string" && json.tag_name.length > 0 ? json.tag_name : null;
-    } catch (e) {
-      throw e instanceof Error ? e : new Error(String(e));
-    }
-  });
-}
-function getJsonWithRedirect(url2, hopsLeft) {
-  return new Promise((resolve17, reject) => {
-    const u = new URL(url2);
-    const headers = {
-      "User-Agent": "codeforge-update-checker",
-      Accept: "application/vnd.github+json"
-    };
-    if (process.env["GITHUB_TOKEN"]) {
-      headers["Authorization"] = `Bearer ${process.env["GITHUB_TOKEN"]}`;
-    }
-    const req = https.request({
-      host: u.hostname,
-      path: u.pathname + (u.search ?? ""),
-      method: "GET",
-      headers,
-      timeout: 5000
-    }, (res) => {
-      const status = res.statusCode ?? 0;
-      if (status >= 300 && status < 400 && res.headers.location) {
-        res.resume();
-        if (hopsLeft <= 0) {
-          reject(new Error("too_many_redirects"));
-          return;
-        }
-        const next = new URL(res.headers.location, url2).toString();
-        getJsonWithRedirect(next, hopsLeft - 1).then(resolve17, reject);
-        return;
-      }
-      if (status === 404) {
-        res.resume();
-        resolve17(null);
-        return;
-      }
-      if (status >= 400) {
-        res.resume();
-        reject(new Error(`http_${status}`));
-        return;
-      }
-      let body = "";
-      res.setEncoding("utf8");
-      res.on("data", (chunk) => body += chunk);
-      res.on("end", () => resolve17(body));
-    });
-    req.on("timeout", () => {
-      req.destroy();
-      reject(new Error("timeout"));
-    });
-    req.on("error", reject);
-    req.end();
-  });
-}
 async function fetchLatestFromNpm(opts) {
   const registry = (opts.registry ?? "https://registry.npmjs.org").replace(/\/+$/, "");
   const channel = opts.channel ?? "latest";
@@ -20426,256 +20302,75 @@ function defaultHttpFetcher(url2, timeoutMs) {
     req.end();
   });
 }
-async function downloadAndExtractBundle(opts) {
-  const tmpRoot = opts.tmpDir ?? mkdtempSync(join24(tmpdir(), "codeforge-update-"));
-  mkdirSync3(tmpRoot, { recursive: true });
-  const fetcher = opts.tarballFetcher ?? defaultBinaryFetcher;
-  const tarballBuf = await fetcher(opts.tarballUrl);
-  verifyIntegrity(tarballBuf, opts.expectedIntegrity);
-  const tarBuf = zlib.gunzipSync(tarballBuf);
-  extractTarToDir(tarBuf, tmpRoot);
-  const bundlePath = join24(tmpRoot, "package", "dist", "index.js");
-  if (!existsSync5(bundlePath)) {
-    throw new Error(`bundle_not_found: ${bundlePath}`);
-  }
-  return { bundlePath, extractDir: tmpRoot };
-}
-function verifyIntegrity(buf, expected) {
-  const m = /^([a-z0-9]+)-(.+)$/i.exec(expected.trim());
-  if (!m) {
-    throw new Error(`integrity_format_invalid: ${expected}`);
-  }
-  const algo = m[1].toLowerCase();
-  const expectedB64 = m[2];
-  if (algo !== "sha512" && algo !== "sha256" && algo !== "sha384") {
-    throw new Error(`integrity_algo_unsupported: ${algo}`);
-  }
-  const actualB64 = createHash4(algo).update(buf).digest("base64");
-  if (actualB64 !== expectedB64) {
-    throw new Error(`integrity_mismatch: expected ${algo}=${expectedB64.slice(0, 16)}... got ${actualB64.slice(0, 16)}...`);
-  }
-}
-function extractTarToDir(tarBuf, destRoot) {
-  let offset = 0;
-  while (offset + 512 <= tarBuf.length) {
-    const header = tarBuf.subarray(offset, offset + 512);
-    if (header.every((b) => b === 0))
-      break;
-    const nameRaw = header.subarray(0, 100).toString("utf8").replace(/\0.*$/, "");
-    if (!nameRaw) {
-      offset += 512;
-      continue;
-    }
-    const sizeOctal = header.subarray(124, 124 + 12).toString("ascii").replace(/\0.*$/, "").trim();
-    const size = sizeOctal ? parseInt(sizeOctal, 8) : 0;
-    const typeFlag = header.subarray(156, 157).toString("ascii");
-    const prefixRaw = header.subarray(345, 345 + 155).toString("utf8").replace(/\0.*$/, "");
-    const fullName = prefixRaw ? `${prefixRaw}/${nameRaw}` : nameRaw;
-    offset += 512;
-    if (typeFlag === "0" || typeFlag === "" || typeFlag === "\x00") {
-      const fileBuf = tarBuf.subarray(offset, offset + size);
-      const dest = join24(destRoot, fullName);
-      mkdirSync3(dirname14(dest), { recursive: true });
-      writeFileSync2(dest, fileBuf);
-    } else if (typeFlag === "5") {
-      mkdirSync3(join24(destRoot, fullName), { recursive: true });
-    }
-    offset += Math.ceil(size / 512) * 512;
-  }
-}
-function defaultBinaryFetcher(url2) {
-  return downloadBinary(url2, 3);
-}
-function downloadBinary(url2, hopsLeft) {
-  return new Promise((resolve17, reject) => {
-    const u = new URL(url2);
-    const req = https.request({
-      host: u.hostname,
-      port: u.port || undefined,
-      path: u.pathname + (u.search ?? ""),
-      method: "GET",
-      headers: { "User-Agent": "codeforge-update-checker" },
-      timeout: 30000
-    }, (res) => {
-      const status = res.statusCode ?? 0;
-      if (status >= 300 && status < 400 && res.headers.location) {
-        res.resume();
-        if (hopsLeft <= 0) {
-          reject(new Error("too_many_redirects"));
-          return;
-        }
-        const next = new URL(res.headers.location, url2).toString();
-        downloadBinary(next, hopsLeft - 1).then(resolve17, reject);
-        return;
-      }
-      if (status >= 400) {
-        res.resume();
-        reject(new Error(`http_${status}`));
-        return;
-      }
-      const chunks = [];
-      res.on("data", (chunk) => chunks.push(chunk));
-      res.on("end", () => resolve17(Buffer.concat(chunks)));
-    });
-    req.on("timeout", () => {
-      req.destroy();
-      reject(new Error("timeout"));
-    });
-    req.on("error", reject);
-    req.end();
-  });
+
+// plugins/update-checker.ts
+var PLUGIN_NAME20 = "update-checker";
+var PLUGIN_VERSION = "3.0.0";
+var _updateCheckStarted = false;
+function getCacheFile() {
+  return join25(process.env["CODEFORGE_CACHE_DIR"] ?? join25(homedir8(), ".cache", "codeforge"), "update-check.json");
 }
-function atomicReplaceBundle(opts) {
-  const { source, target, oldVersion } = opts;
-  const keep = opts.keepBackups ?? 3;
-  if (!existsSync5(source)) {
-    throw new Error(`atomic_source_missing: ${source}`);
-  }
-  mkdirSync3(dirname14(target), { recursive: true });
-  const newPath = `${target}.new`;
-  const backupPath = `${target}.bak.${oldVersion}`;
-  let strategy = "rename";
+function readLastInstalledVersion() {
   try {
-    copyFileSync(source, newPath);
-    if (existsSync5(target)) {
-      try {
-        renameSync(target, backupPath);
-      } catch (e) {
-        const code = e.code;
-        if (code === "EBUSY" || code === "EPERM" || code === "EACCES") {
-          copyFileSync(target, backupPath);
-          copyFileSync(newPath, target);
-          try {
-            unlinkSync(newPath);
-          } catch {}
-          strategy = "copy_fallback";
-          cleanupOldBackups(target, keep);
-          return { backupPath, strategy };
-        }
-        throw e;
-      }
-    }
-    try {
-      renameSync(newPath, target);
-    } catch (e) {
-      const code = e.code;
-      if (code === "EBUSY" || code === "EPERM" || code === "EACCES") {
-        copyFileSync(newPath, target);
-        try {
-          unlinkSync(newPath);
-        } catch {}
-        strategy = "copy_fallback";
-      } else {
-        throw e;
-      }
-    }
-    cleanupOldBackups(target, keep);
-    return { backupPath, strategy };
-  } catch (e) {
-    try {
-      if (existsSync5(newPath))
-        unlinkSync(newPath);
-    } catch {}
-    throw e;
+    const f = getCacheFile();
+    if (!existsSync5(f))
+      return null;
+    const o = JSON.parse(readFileSync6(f, "utf8"));
+    return typeof o.installedVersion === "string" ? o.installedVersion : null;
+  } catch {
+    return null;
   }
 }
-function cleanupOldBackups(target, keep) {
-  if (keep <= 0)
-    return;
+function writeLastInstalledVersion(v) {
   try {
-    const dir = dirname14(target);
-    const base = target.substring(dir.length + 1);
-    const prefix = `${base}.bak.`;
-    const all = readdirSync3(dir).filter((f) => f.startsWith(prefix)).map((f) => {
-      const full = join24(dir, f);
-      let mtimeMs = 0;
-      try {
-        mtimeMs = statSync4(full).mtimeMs;
-      } catch {}
-      return { full, mtimeMs };
-    }).sort((a, b) => b.mtimeMs - a.mtimeMs);
-    const toRemove = all.slice(keep);
-    for (const item of toRemove) {
-      try {
-        unlinkSync(item.full);
-      } catch {}
-    }
+    const f = getCacheFile();
+    mkdirSync3(dirname15(f), { recursive: true });
+    writeFileSync2(f, JSON.stringify({ installedVersion: v }, null, 2), "utf8");
   } catch {}
 }
-function loadCompatibility(opts) {
+function resolveNodeBin() {
+  const w = process.platform === "win32";
   try {
-    let file = opts?.file;
-    if (!file) {
-      const root = opts?.cwd ?? inferPluginRoot();
-      if (!root)
-        return null;
-      file = join24(root, "compatibility.json");
-    }
-    if (!existsSync5(file))
-      return null;
-    const raw = readFileSync5(file, "utf8");
-    const obj = JSON.parse(raw);
-    if (!obj || typeof obj !== "object")
-      return null;
-    const oc = obj["opencode"];
-    if (!oc || typeof oc !== "object")
-      return null;
-    const o = oc;
-    const min_version = typeof o["min_version"] === "string" ? o["min_version"] : "";
-    const max_version = typeof o["max_version"] === "string" ? o["max_version"] : null;
-    const tested_versions = Array.isArray(o["tested_versions"]) ? o["tested_versions"].filter((v) => typeof v === "string") : [];
-    if (!min_version)
-      return null;
-    return { min_version, max_version, tested_versions };
-  } catch {
-    return null;
+    const r = spawnSync2(w ? "where" : "which", ["node"], { encoding: "utf8", stdio: "pipe" });
+    if (r.status === 0 && r.stdout.trim())
+      return r.stdout.trim().split(/\r?\n/)[0].trim();
+  } catch {}
+  for (const c of w ? ["C:\\Program Files\\nodejs\\node.exe"] : ["/usr/local/bin/node", "/usr/bin/node", "/opt/homebrew/bin/node", "/opt/homebrew/opt/node/bin/node"]) {
+    try {
+      if (spawnSync2(c, ["--version"], { stdio: "pipe", timeout: 2000 }).status === 0)
+        return c;
+    } catch {}
   }
+  return process.execPath;
 }
-function inferPluginRoot() {
+function resolveNpmBin() {
+  const w = process.platform === "win32";
   try {
-    const here = fileURLToPath2(import.meta.url);
-    return dirname14(dirname14(here));
-  } catch {
-    return null;
+    const r = spawnSync2(w ? "where" : "which", ["npm"], { encoding: "utf8", stdio: "pipe" });
+    if (r.status === 0 && r.stdout.trim())
+      return r.stdout.trim().split(/\r?\n/)[0].trim();
+  } catch {}
+  for (const c of w ? ["C:\\Program Files\\nodejs\\npm.cmd"] : ["/usr/local/bin/npm", "/usr/bin/npm", "/opt/homebrew/bin/npm"]) {
+    try {
+      if (spawnSync2(c, ["--version"], { stdio: "pipe", timeout: 2000 }).status === 0)
+        return c;
+    } catch {}
   }
+  return "npm";
 }
-function compareOpencodeVersion(opts) {
-  const cur = (opts.currentOpencodeVer ?? "").trim();
-  const compat = opts.compat;
-  if (!compat) {
-    return { status: "unknown", message: "compatibility.json 不可用，跳过版本校验" };
-  }
-  if (!cur || cur === "unknown") {
-    return { status: "unknown", message: "无法检测 opencode 版本（OPENCODE_VERSION 未设）" };
-  }
-  if (compat.tested_versions.includes(cur)) {
-    return {
-      status: "supported",
-      message: `opencode ${cur} 在 CodeForge 已测试版本列表内`
-    };
-  }
-  if (cmpVersion(cur, compat.min_version) < 0) {
-    return {
-      status: "below_min",
-      message: `opencode ${cur} 低于 CodeForge 要求的最低版本 ${compat.min_version}`
-    };
-  }
-  if (compat.max_version && cmpVersion(cur, compat.max_version) > 0) {
-    return {
-      status: "above_max",
-      message: `opencode ${cur} 高于 CodeForge 已知兼容上限 ${compat.max_version}`
-    };
-  }
-  const testedDisplay = compat.tested_versions.length > 0 ? compat.tested_versions.join(", ") : "(空)";
-  return {
-    status: "untested",
-    message: `opencode ${cur} 未在 CodeForge 已测试版本列表中（已测：${testedDisplay}）`
-  };
+function getNpmGlobalRoot(npmBin) {
+  try {
+    const r = spawnSync2(npmBin, ["root", "-g"], {
+      encoding: "utf8",
+      stdio: "pipe",
+      timeout: 1e4,
+      shell: process.platform === "win32"
+    });
+    if (r.status === 0 && r.stdout.trim())
+      return r.stdout.trim();
+  } catch {}
+  return null;
 }
-
-// plugins/update-checker.ts
-var PLUGIN_NAME20 = "update-checker";
-var PLUGIN_VERSION = "2.0.0";
 logLifecycle(PLUGIN_NAME20, "import", { version: PLUGIN_VERSION });
 var updateCheckerServer = async (ctx) => {
   const yieldResult = shouldYieldToLocalPlugin({ directory: ctx.directory });
@@ -20699,45 +20394,20 @@ var updateCheckerServer = async (ctx) => {
   logLifecycle(PLUGIN_NAME20, "activate", {
     version: PLUGIN_VERSION,
     auto_check_enabled: u.auto_check_enabled,
-    interval_hours: u.interval_hours,
     package: u.package,
     registry: u.registry,
     channel: u.channel,
-    auto_install: u.auto_install,
-    backup_keep: u.backup_keep,
-    repo_fallback: u.repo,
-    config_source: "codeforge.json"
-  });
-  await safeAsync(PLUGIN_NAME20, "opencode_version_check", async () => {
-    const compat = loadCompatibility();
-    const opencodeVer = detectOpencodeVersion();
-    const verdict = compareOpencodeVersion({
-      currentOpencodeVer: opencodeVer,
-      compat
-    });
-    safeWriteLog(PLUGIN_NAME20, {
-      level: "info",
-      msg: "opencode_version_check",
-      opencodeVer,
-      status: verdict.status,
-      verdict_message: verdict.message
-    });
-    if (verdict.status === "untested" || verdict.status === "above_max") {
-      await postToast(ctx, `[CodeForge] ⚠ ${verdict.message}
-   遇到问题请在 issue 中附带本提示`);
-    } else if (verdict.status === "below_min") {
-      const minVer = compat?.min_version ?? "(unknown)";
-      await postToast(ctx, `[CodeForge] ⚠ ${verdict.message}
-   请升级 opencode 到 ${minVer}+`);
-    }
+    auto_install: u.auto_install
   });
   if (!u.auto_check_enabled) {
-    safeWriteLog(PLUGIN_NAME20, {
-      level: "info",
-      msg: "auto-check disabled (codeforge.json update.auto_check_enabled=false)"
-    });
+    safeWriteLog(PLUGIN_NAME20, { level: "info", msg: "auto_check_disabled" });
+    return {};
+  }
+  if (_updateCheckStarted) {
+    safeWriteLog(PLUGIN_NAME20, { level: "info", msg: "check_skipped_already_running" });
     return {};
   }
+  _updateCheckStarted = true;
   setImmediate(() => {
     safeAsync(PLUGIN_NAME20, "checkAndMaybeUpdate", async () => {
       const local = readLocalVersion();
@@ -20750,224 +20420,72 @@ var updateCheckerServer = async (ctx) => {
           timeoutMs: 5000
         });
       } catch (e) {
-        safeWriteLog(PLUGIN_NAME20, {
-          level: "warn",
-          msg: "npm_fetch_failed",
-          error: e.message
-        });
-        await fallbackToGitHubReleases(ctx, u);
+        safeWriteLog(PLUGIN_NAME20, { level: "warn", msg: "npm_fetch_failed", error: e.message });
         return;
       }
-      if (!npmResult) {
-        safeWriteLog(PLUGIN_NAME20, {
-          level: "info",
-          msg: "npm_no_release",
-          package: u.package,
-          channel: u.channel
-        });
+      if (!npmResult)
         return;
-      }
-      const hasUpdate = cmpVersion(local, npmResult.version) < 0;
-      safeWriteLog(PLUGIN_NAME20, {
-        level: "info",
-        msg: "npm_check_result",
-        local,
-        remote: npmResult.version,
-        hasUpdate,
-        tarballUrl: npmResult.tarballUrl
-      });
+      const remote = npmResult.version;
+      const hasUpdate = cmpVersion(local, remote) < 0;
+      safeWriteLog(PLUGIN_NAME20, { level: "info", msg: "npm_check_result", local, remote, hasUpdate });
       if (!hasUpdate)
         return;
+      const lastInstalled = readLastInstalledVersion();
+      if (lastInstalled === remote) {
+        safeWriteLog(PLUGIN_NAME20, { level: "info", msg: "install_skipped_already_installed", version: remote });
+        return;
+      }
       if (!u.auto_install) {
-        await postToast(ctx, `[CodeForge] 有新版本 ${local} → ${npmResult.version}
-   更新命令：npx ${u.package} install --global`);
+        await postToast(ctx, `[codeforge] 有新版本 ${local} → ${remote}
+   运行：codeforge upgrade`);
         return;
       }
-      await safeAsync(PLUGIN_NAME20, "auto_install_full", async () => {
-        const target = getOpencodeBundlePath();
-        if (!target) {
-          safeWriteLog(PLUGIN_NAME20, {
-            level: "warn",
-            msg: "auto_install_skip",
-            reason: "无法定位 opencode bundle 路径"
-          });
-          await postToast(ctx, `[CodeForge] 有新版本 ${local} → ${npmResult.version}
-   自动安装失败：找不到 bundle，请手动 npx ${u.package} install`);
+      await safeAsync(PLUGIN_NAME20, "auto_install", async () => {
+        const nodeBin = resolveNodeBin();
+        const npmBin = resolveNpmBin();
+        safeWriteLog(PLUGIN_NAME20, { level: "info", msg: "auto_install_start", local, remote, nodeBin, npmBin });
+        const r1 = spawnSync2(npmBin, ["install", "-g", `${u.package}@${remote}`], {
+          stdio: "pipe",
+          encoding: "utf8",
+          timeout: 120000,
+          shell: process.platform === "win32"
+        });
+        if (r1.status !== 0) {
+          safeWriteLog(PLUGIN_NAME20, { level: "warn", msg: "npm_install_failed", status: r1.status, stderr: (r1.stderr ?? "").slice(0, 300) });
+          await postToast(ctx, `[codeforge] 自动升级失败（${local} → ${remote}），请手动运行：codeforge upgrade`);
+          return;
+        }
+        safeWriteLog(PLUGIN_NAME20, { level: "info", msg: "npm_install_success", remote });
+        const npmRoot = getNpmGlobalRoot(npmBin);
+        const codeForgeBin = npmRoot ? join25(npmRoot, "@andyqiu", "codeforge", "bin", "codeforge.mjs") : null;
+        if (!codeForgeBin || !existsSync5(codeForgeBin)) {
+          safeWriteLog(PLUGIN_NAME20, { level: "warn", msg: "codeforge_bin_not_found", path: codeForgeBin ?? "null" });
+          await postToast(ctx, `[codeforge] ⚠ npm 包已升级 ${local} → ${remote}，但资产部署未完成。下次启动将重试，或手动运行：codeforge upgrade`);
           return;
         }
-        const { bundlePath, extractDir } = await downloadAndExtractBundle({
-          tarballUrl: npmResult.tarballUrl,
-          expectedIntegrity: npmResult.integrity
+        const r2 = spawnSync2(nodeBin, [codeForgeBin, "install", "--global", "--skip-build"], {
+          stdio: "pipe",
+          encoding: "utf8",
+          timeout: 60000,
+          shell: false
         });
-        try {
-          const installMjs = join25(extractDir, "package", "install.mjs");
-          if (existsSync6(installMjs)) {
-            const nodeBin = resolveNodeBin();
-            const r = spawnSync2(nodeBin, [installMjs, "--global", "--skip-build"], {
-              cwd: join25(extractDir, "package"),
-              stdio: "pipe",
-              encoding: "utf8"
-            });
-            if (r.status === 0) {
-              safeWriteLog(PLUGIN_NAME20, {
-                level: "info",
-                msg: "auto_install_full_success",
-                local,
-                remote: npmResult.version,
-                strategy: "install.mjs"
-              });
-              await postToast(ctx, `[CodeForge] ✅ 已全量更新 ${local} → ${npmResult.version}（bundle + agents/skills/commands/workflows，重启 opencode 生效）
-   回滚：npx ${u.package} rollback`);
-              return;
-            }
-            safeWriteLog(PLUGIN_NAME20, {
-              level: "warn",
-              msg: "install_mjs_failed",
-              nodeBin,
-              status: r.status,
-              stderr: r.stderr?.slice(0, 500),
-              stdout: r.stdout?.slice(0, 500)
-            });
-          } else {
-            safeWriteLog(PLUGIN_NAME20, {
-              level: "info",
-              msg: "install_mjs_absent_fallback_bundle_only",
-              installMjs
-            });
-          }
-          const { backupPath, strategy } = atomicReplaceBundle({
-            source: bundlePath,
-            target,
-            oldVersion: local,
-            keepBackups: u.backup_keep
-          });
-          safeWriteLog(PLUGIN_NAME20, {
-            level: "info",
-            msg: "auto_install_bundle_only_success",
-            local,
-            remote: npmResult.version,
-            target,
-            backupPath,
-            strategy
-          });
-          await postToast(ctx, `[CodeForge] ✅ 已更新 bundle ${local} → ${npmResult.version}（仅 bundle，agents/skills 未变；重启生效）
-   回滚：npx ${u.package} rollback`);
-        } finally {
-          try {
-            rmSync(extractDir, { recursive: true, force: true });
-          } catch {}
+        if (r2.status !== 0) {
+          safeWriteLog(PLUGIN_NAME20, { level: "warn", msg: "codeforge_install_failed", status: r2.status, stderr: (r2.stderr ?? "").slice(0, 300) });
+          await postToast(ctx, `[codeforge] ⚠ npm 包已升级 ${local} → ${remote}，但资产部署失败。下次启动将重试，或手动运行：codeforge upgrade`);
+          return;
         }
+        writeLastInstalledVersion(remote);
+        safeWriteLog(PLUGIN_NAME20, { level: "info", msg: "auto_install_full_success", local, remote, nodeBin, npmBin });
+        await postToast(ctx, `[codeforge] ✅ 已升级 ${local} → ${remote}（重启 opencode 生效）
+   回滚：npm install -g ${u.package}@${local}`);
       });
     });
   });
   return {};
 };
-function resolveNodeBin() {
-  const IS_WIN = process.platform === "win32";
-  try {
-    const r = spawnSync2(IS_WIN ? "where" : "which", ["node"], {
-      encoding: "utf8",
-      stdio: "pipe"
-    });
-    if (r.status === 0 && r.stdout.trim()) {
-      const first = r.stdout.trim().split(/\r?\n/)[0].trim();
-      if (first)
-        return first;
-    }
-  } catch {}
-  const candidates = IS_WIN ? [
-    "C:\\Program Files\\nodejs\\node.exe",
-    "C:\\Program Files (x86)\\nodejs\\node.exe"
-  ] : [
-    "/usr/local/bin/node",
-    "/usr/bin/node",
-    "/opt/homebrew/bin/node",
-    "/opt/homebrew/opt/node/bin/node"
-  ];
-  for (const c of candidates) {
-    try {
-      const t = spawnSync2(c, ["--version"], {
-        encoding: "utf8",
-        stdio: "pipe",
-        timeout: 2000
-      });
-      if (t.status === 0)
-        return c;
-    } catch {}
-  }
-  return process.execPath;
-}
-function detectOpencodeVersion() {
-  const env = process.env["OPENCODE_VERSION"];
-  if (env && env.trim().length > 0)
-    return env.trim();
-  return "unknown";
-}
-function getOpencodeBundlePath() {
-  const candidates = [];
-  candidates.push(join25(homedir9(), ".config", "opencode", "codeforge", "index.js"));
-  if (process.platform === "win32") {
-    const appData = process.env["APPDATA"];
-    if (appData)
-      candidates.push(join25(appData, "opencode", "codeforge", "index.js"));
-    const localAppData = process.env["LOCALAPPDATA"];
-    if (localAppData)
-      candidates.push(join25(localAppData, "opencode", "codeforge", "index.js"));
-  }
-  for (const c of candidates) {
-    if (existsSync6(c))
-      return c;
-  }
-  return candidates[0] ?? null;
-}
-async function fallbackToGitHubReleases(ctx, u) {
-  await safeAsync(PLUGIN_NAME20, "github_fallback", async () => {
-    const result = await checkUpdateOnce({
-      repo: u.repo,
-      intervalMs: u.interval_hours * 3600 * 1000
-    });
-    await reportLegacyResult(ctx, result, u.repo);
-  });
-}
-async function reportLegacyResult(ctx, result, repo) {
-  if (result.error && !result.fromCache) {
-    safeWriteLog(PLUGIN_NAME20, {
-      level: "warn",
-      msg: `update check failed: ${result.error}`,
-      ...result
-    });
-    return;
-  }
-  if (!result.hasUpdate) {
-    safeWriteLog(PLUGIN_NAME20, {
-      level: "info",
-      msg: `up-to-date (local=${result.local}, remote=${result.remote}${result.fromCache ? ", from_cache" : ""})`,
-      ...result
-    });
-    return;
-  }
-  const updateCmd = `bunx --bun github:${repo} install`;
-  const toast = `[CodeForge] 有新版本：${result.local} → ${result.remote}
-  更新命令：${updateCmd}`;
-  safeWriteLog(PLUGIN_NAME20, {
-    level: "info",
-    msg: "new_version_available_github_fallback",
-    local: result.local,
-    remote: result.remote,
-    update_command: updateCmd,
-    fromCache: result.fromCache
-  });
-  await postToast(ctx, toast);
-}
 async function postToast(ctx, message) {
   await safeAsync(PLUGIN_NAME20, "client.app.log", async () => {
-    await ctx.client.app.log({
-      body: {
-        service: PLUGIN_NAME20,
-        level: "info",
-        message
-      }
-    });
+    await ctx.client.app.log({ body: { service: PLUGIN_NAME20, level: "info", message } });
   });
 }
 var handler20 = updateCheckerServer;