@boyingliu01/xp-gate 0.18.4 → 0.19.0

package/plugins/dsh/skills/clipboard-vision/scripts/clipboard-vision.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+api_base="${CLIPBOARD_VISION_API_BASE:-http://127.0.0.1:11434/v1}"
+model="${CLIPBOARD_VISION_MODEL:-}"
+api_key="${CLIPBOARD_VISION_API_KEY:-}"
+max_bytes="${CLIPBOARD_VISION_MAX_BYTES:-10485760}"
+allow_remote=false
+confirm_remote=""
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --allow-remote) allow_remote=true; shift ;;
+    --confirm-remote)
+      [ "$#" -ge 2 ] || { printf '%s\n' 'Error: --confirm-remote requires the disclosed token' >&2; exit 2; }
+      confirm_remote="$2"
+      shift 2
+      ;;
+    --help)
+      printf '%s\n' 'Usage: clipboard-vision.sh [--allow-remote --confirm-remote TOKEN]'
+      exit 0
+      ;;
+    *) printf 'Error: unknown option: %s\n' "$1" >&2; exit 2 ;;
+  esac
+done
+
+[ -n "$model" ] || { printf '%s\n' 'Error: CLIPBOARD_VISION_MODEL is required' >&2; exit 2; }
+case "$max_bytes" in *[!0-9]*|'') printf '%s\n' 'Error: CLIPBOARD_VISION_MAX_BYTES must be a positive integer' >&2; exit 2 ;; esac
+[ "$max_bytes" -gt 0 ] || { printf '%s\n' 'Error: CLIPBOARD_VISION_MAX_BYTES must be positive' >&2; exit 2; }
+
+endpoint_info=$(python3 - "$api_base" "$model" <<'PY'
+import hashlib
+import ipaddress
+import sys
+import urllib.parse
+
+url = urllib.parse.urlparse(sys.argv[1])
+if url.scheme not in {"http", "https"} or not url.hostname or url.username or url.password or url.query or url.fragment:
+    raise SystemExit(2)
+try:
+    loopback = ipaddress.ip_address(url.hostname).is_loopback
+except ValueError:
+    loopback = False
+try:
+    port = url.port or (443 if url.scheme == "https" else 80)
+except ValueError:
+    raise SystemExit(2)
+print("local" if loopback else "remote")
+hostname = url.hostname.lower()
+print(hostname)
+display_host = f"[{hostname}]" if ":" in hostname else hostname
+base_path = url.path.rstrip("/")
+effective = f"{url.scheme.lower()}://{display_host}:{port}{base_path}/chat/completions"
+print(effective)
+print(hashlib.sha256(f"{effective}\n{sys.argv[2]}".encode()).hexdigest())
+PY
+) || { printf '%s\n' 'Error: invalid CLIPBOARD_VISION_API_BASE' >&2; exit 2; }
+endpoint_kind=$(printf '%s\n' "$endpoint_info" | sed -n '1p')
+effective_endpoint=$(printf '%s\n' "$endpoint_info" | sed -n '3p')
+expected_confirmation=$(printf '%s\n' "$endpoint_info" | sed -n '4p')
+
+if [ "$endpoint_kind" = remote ]; then
+  printf 'Remote disclosure: clipboard image data will be sent to %s using model %s.\n' "$effective_endpoint" "$model" >&2
+  printf 'Confirmation token for this canonical endpoint and model: %s\n' "$expected_confirmation" >&2
+  if [ "$allow_remote" != true ] || [ "$confirm_remote" != "$expected_confirmation" ]; then
+    printf '%s\n' 'Error: remote endpoint requires --allow-remote and the disclosed --confirm-remote token' >&2
+    exit 2
+  fi
+fi
+
+work_dir=$(mktemp -d "${TMPDIR:-/tmp}/clipboard-vision.XXXXXX")
+image_file="$work_dir/clipboard.png"
+request_file="$work_dir/request.json"
+response_file="$work_dir/response.json"
+auth_file="$work_dir/auth-header"
+cleanup() { rm -rf -- "$work_dir"; }
+trap cleanup EXIT HUP INT TERM
+
+if command -v pngpaste >/dev/null 2>&1; then
+  pngpaste "$image_file"
+elif command -v wl-paste >/dev/null 2>&1; then
+  wl-paste --no-newline --type image/png > "$image_file"
+elif command -v import >/dev/null 2>&1; then
+  import clipboard: "$image_file"
+else
+  printf '%s\n' 'Error: install pngpaste, wl-paste, or ImageMagick import' >&2
+  exit 2
+fi
+
+[ -s "$image_file" ] || { printf '%s\n' 'Error: clipboard does not contain an image' >&2; exit 2; }
+image_bytes=$(wc -c < "$image_file" | tr -d '[:space:]')
+[ "$image_bytes" -le "$max_bytes" ] || { printf 'Error: clipboard image exceeds %s bytes\n' "$max_bytes" >&2; exit 2; }
+
+python3 - "$image_file" "$request_file" "$model" <<'PY'
+import base64
+import json
+import pathlib
+import sys
+
+image = base64.b64encode(pathlib.Path(sys.argv[1]).read_bytes()).decode("ascii")
+request = {
+    "model": sys.argv[3],
+    "messages": [{"role": "user", "content": [
+        {"type": "text", "text": "Describe this clipboard image."},
+        {"type": "image_url", "image_url": {"url": "data:image/png;base64," + image}},
+    ]}],
+}
+pathlib.Path(sys.argv[2]).write_text(json.dumps(request), encoding="utf-8")
+PY
+
+curl_args=(--silent --show-error --max-redirs 0 --output "$response_file" --write-out '%{http_code}' --header 'Content-Type: application/json' --data-binary "@$request_file")
+if [ -n "$api_key" ]; then
+  case "$api_key" in *$'\n'*|*$'\r'*) printf '%s\n' 'Error: invalid CLIPBOARD_VISION_API_KEY' >&2; exit 2 ;; esac
+  umask 077
+  printf 'Authorization: Bearer %s\n' "$api_key" > "$auth_file"
+  chmod 600 "$auth_file"
+  curl_args+=(--header "@$auth_file")
+fi
+status=$(curl "${curl_args[@]}" "$effective_endpoint") || { printf '%s\n' 'Error: vision API request failed' >&2; exit 1; }
+case "$status" in 2??) ;; *) printf 'Error: vision API returned HTTP %s (body redacted)\n' "$status" >&2; exit 1 ;; esac
+
+result=$(python3 - "$response_file" <<'PY'
+import json
+import pathlib
+import sys
+
+try:
+    data = json.loads(pathlib.Path(sys.argv[1]).read_text(encoding="utf-8"))
+    value = data["choices"][0]["message"]["content"]
+    if not isinstance(value, str):
+        raise ValueError
+except (KeyError, IndexError, TypeError, ValueError, json.JSONDecodeError):
+    raise SystemExit(2)
+print(value)
+PY
+) || { printf '%s\n' 'Error: invalid vision API response (body redacted)' >&2; exit 1; }
+
+printf '%s\n' "$result"

package/plugins/dsh/skills/delphi-review/.delphi-config.json.example

@@ -0,0 +1,70 @@
+{
+  "$comment": [
+    "Delphi Review Configuration Template",
+    "======================================",
+    "Copy this file to .delphi-config.json and fill in your API keys.",
+    "Place this file alongside SKILL.md in the delphi-review skill directory.",
+    "Exactly three roles are required, with distinct trimmed executable model IDs.",
+    "",
+    "Provider and vendor are unrestricted. provider=local is a fallback and cannot count as a successful expert execution.",
+    "cross_provider_required is deprecated and ignored with warning code cross_provider_required_ignored."
+  ],
+
+  "active_profile": "default",
+
+  "profiles": {
+    "default": {
+      "providers": {
+        "bailian-tp": {
+          "base_url": "https://dashscope.aliyuncs.com/compatible-mode/v1",
+          "api_key": "YOUR_API_KEY"
+        }
+      },
+      "experts": {
+        "architecture": {
+          "provider": "bailian-tp",
+          "model": "qwen-plus"
+        },
+        "technical": {
+          "provider": "bailian-tp",
+          "model": "deepseek-v3"
+        },
+        "feasibility": {
+          "provider": "bailian-tp",
+          "model": "glm-4.5"
+        }
+      }
+    },
+
+    "starter": {
+      "$comment": "One provider and token plan serving three distinct models",
+      "providers": {
+        "bailian-tp": {
+          "base_url": "https://dashscope.aliyuncs.com/compatible-mode/v1",
+          "api_key": "YOUR_API_KEY"
+        }
+      },
+      "experts": {
+        "architecture": {
+          "provider": "bailian-tp",
+          "model": "qwen-plus"
+        },
+        "technical": {
+          "provider": "bailian-tp",
+          "model": "deepseek-v3"
+        },
+        "feasibility": {
+          "provider": "bailian-tp",
+          "model": "glm-4.5"
+        }
+      }
+    }
+  },
+
+  "consensus": {
+    "threshold_percent": 90,
+    "max_review_rounds": 5,
+    "distinct_models_required": true,
+    "cross_provider_required": true
+  }
+}

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -0,0 +1,67 @@
+# SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
+
+**Generated:** 2026-08-24
+**Commit:** a1a4683
+**Branch:** dsh-plugin
+**Version:** 0.19.0.0
+
+## OVERVIEW
+Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.
+
+## STRUCTURE
+```
+skills/delphi-review/
+├── SKILL.md                  # Core Delphi methodology + output contract
+├── INSTALL.md                # Setup instructions
+├── AGENTS.md                 # This file
+├── evals/                    # Evaluation test cases
+├── opencode.json.delphi.example  # OpenCode delphi config example
+├── references/
+│   └── code-walkthrough.md   # Code-walkthrough mode specification
+└── .delphi-config.json.example   # 3-expert config template
+```
+
+## WHERE TO LOOK
+| Task | Location | Notes |
+|------|----------|-------|
+| Core methodology | SKILL.md | Delphi process, expert roles, consensus rules |
+| Code-walkthrough | references/code-walkthrough.md | Pre-push mode: complete review evidence with no hard file/LOC threshold |
+| Config example | .delphi-config.json.example | 3 experts, distinct models |
+
+## CONVENTIONS
+- 3 experts anonymous in Round 1 (no cross-expert bias)
+- ≥90% consensus threshold (was 95%, now unified to 90%)
+- Max 5 rounds before forcing decision
+- Provider/vendor/nationality unrestricted; exactly three distinct trimmed requested model IDs are required
+- Model selection: reads `delphi-reviewer-*` agent `model` fields from `opencode.json`
+- No hardcoded model lists — models defined by user's `opencode.json` configuration
+- Code-walkthrough mode: triggered on git push, stores result in .code-walkthrough-result.json
+- Code-walkthrough skipped on main/master pushes (by design)
+
+## ANTI-PATTERNS (THIS PROJECT)
+- Do NOT terminate before achieving true consensus (≥90%)
+- Do NOT reveal other experts' opinions during Round 1
+- Do NOT accept partial agreement without resolution
+- Do NOT auto-skip or bypass code-walkthrough based on change size; review large diffs completely or split them by user choice
+- Do NOT degrade to single model on API errors (BLOCK)
+- Do NOT declare complete without writing .code-walkthrough-result.json
+- Do NOT treat `provider: local` fallback as an executed expert
+
+## UNIQUE STYLES
+- Anonymous expert reviews (Round 1)
+- Statistical consensus measurement (≥90% threshold)
+- Three modes: requirements review + design review + code-walkthrough
+- Pre-push integration: .code-walkthrough-result.json stores commit hash + verdict
+- Delphi guard in claude-code plugin: blocks Edit/Write before APPROVAL
+
+## COMMANDS
+```bash
+/delphi-review                              # Design review mode
+/delphi-review --mode requirements          # Phase 2 R1 requirements review
+/delphi-review --mode code-walkthrough      # Pre-push code walkthrough
+```
+
+## NOTES
+- Used by pre-push hook for code-walkthrough validation
+- Delphi guard (claude-code plugin) reads .sprint-state/delphi-reviewed.json
+- Code-walkthrough result must match commit hash for verification

package/plugins/dsh/skills/delphi-review/INSTALL.md

@@ -0,0 +1,150 @@
+# Installing and Configuring Delphi Review
+
+This guide walks you through setting up the Delphi consensus review skill in your OpenCode environment.
+
+## Prerequisites
+
+- OpenCode installed and configured
+- Exactly **3 callable expert model configurations** are required.
+- The three configurations must use distinct trimmed executable model IDs. They may share one provider and token plan.
+
+> Provider, vendor, gateway, and model nationality are unrestricted. The enforced diversity boundary is three distinct requested model IDs, not provider diversity.
+
+## Quick Setup (3 steps)
+
+### Step 1: Copy the configuration template
+
+```bash
+# From your project root (where opencode.json lives):
+cp skills/delphi-review/.delphi-config.json.example .delphi-config.json
+```
+
+This file maps abstract expert roles to agent names. You typically don't need to edit this unless you want custom agent names.
+
+### Step 2: Add agent definitions to opencode.json
+
+Copy the `agent` block from `skills/delphi-review/opencode.json.delphi.example` into your `opencode.json`.
+
+Then replace the provider/model placeholders:
+
+```json
+// Before (template):
+"model": "YOUR_PROVIDER/YOUR_MODEL_A"
+
+// After (your config):
+"model": "bailian-tp/qwen-plus"
+// The other two role model fields must be different trimmed IDs.
+```
+
+### Step 3: Ensure provider configuration exists
+
+Your `opencode.json` must have the provider definitions. If you're using OpenCode's built-in providers (OpenAI, Anthropic, etc.), you just need API keys set in your environment.
+
+For custom providers (like Ali Bailian), add a provider entry:
+
+```json
+"provider": {
+  "my-custom-provider": {
+    "npm": "@ai-sdk/anthropic",
+    "name": "My Custom Provider",
+    "options": {
+      "baseURL": "https://your-api-endpoint.com/v1",
+      "apiKey": "your-api-key"
+    },
+    "models": {
+      "my-model-name": {
+        "name": "My Model Name",
+        "modalities": {
+          "input": ["text"],
+          "output": ["text"]
+        },
+        "limit": {
+          "context": 128000,
+          "output": 8192
+        }
+      }
+    }
+  }
+}
+```
+
+## Model Recommendations
+
+The skill requires exactly three experts for every mode. Choose three models that are callable through your configured provider.
+
+| Expert Role | Recommended | Alternatives |
+|-------------|-------------|-------------|
+| **Architecture (Expert A)** | Claude Sonnet 4 | GPT-4o, Qwen-Plus, Gemini 2.5 Pro |
+| **Technical (Expert B)** | Claude Haiku | Qwen-Coder, DeepSeek-Coder, GPT-4o-mini |
+| **Feasibility (Expert C)** | Claude Opus | GPT-4, Gemini 2.5 Pro, Qwen-Max |
+
+**Minimum viable setup**:
+- Expert A: architecture model
+- Expert B: technical model
+- Expert C: feasibility model
+- All three requested model IDs must be distinct. A `provider: local` fallback does not count.
+
+## Configuration File Reference
+
+### `.delphi-config.json`
+
+| Field | Description | Default |
+|-------|-------------|---------|
+| `num_experts` | Number of experts to use | 3, fixed |
+| `experts.architecture` | Architecture reviewer configuration | Required |
+| `experts.technical` | Technical reviewer configuration | Required |
+| `experts.feasibility` | Feasibility reviewer configuration | Required for 3-expert mode |
+    | `consensus.threshold_percent` | Agreement threshold | 90 |
+| `consensus.max_review_rounds` | Maximum review rounds | 5 |
+| `consensus.cross_provider_required` | Deprecated and ignored; emits `cross_provider_required_ignored` | false or omitted |
+
+### `opencode.json` agent block
+
+| Field | Description |
+|-------|-------------|
+| `model` | Provider/model identifier (e.g., `openai/gpt-4o`) |
+| `mode` | Must be `"subagent"` |
+| `prompt` | Expert role instructions |
+| `tools` | Tool permissions (read: true, write: false recommended) |
+
+## Usage
+
+Once configured, invoke the skill via:
+
+```bash
+/delphi-review
+```
+
+Or reference it in your workflows. The skill will automatically use the agents defined in your `opencode.json`.
+
+## Troubleshooting
+
+### "Agent delphi-reviewer-xxx not found"
+
+The agent definitions in `opencode.json` don't match the names in `.delphi-config.json`. Verify:
+1. Agent names in `.delphi-config.json` match keys in `opencode.json` `agent` block
+2. opencode.js is valid JSON (use `jq . opencode.json` to verify)
+
+### "Model YOUR_PROVIDER/YOUR_MODEL not available"
+
+You forgot to replace the placeholder. Search for `YOUR_PROVIDER` in your opencode.json and replace with actual values.
+
+### Both experts gave identical feedback
+
+Shared providers are allowed. Configure three distinct executable model IDs and verify all three calls succeed.
+
+### Review takes too long / costs too much
+
+Do not reduce the expert count. Use three callable models and keep the threshold and round bounds unchanged.
+
+## Advanced: JSON Schema Validation
+
+For IDE autocompletion and validation, reference the schema in your `.delphi-config.json`:
+
+```json
+{
+  "$schema": "https://example.com/delphi-config.schema.json"
+}
+```
+
+The schema file is available at `.delphi-config.schema.json` in this directory.