@boyingliu01/xp-gate 0.19.1 → 0.19.3

package/plugins/qoder/skills/clipboard-vision/clipboard-vision/__tests__/clipboard-vision.test.cjs

@@ -1,273 +0,0 @@
-/**
- * @test REQ-379 privacy-safe clipboard vision
- * @intent Verify one-shot clipboard image analysis enforces local-first privacy boundaries
- * @covers AC-379-01, AC-379-02, AC-379-03, AC-379-04, AC-379-05, AC-379-06
- */
-const fs = require('fs');
-const crypto = require('crypto');
-const os = require('os');
-const path = require('path');
-const { spawnSync } = require('child_process');
-
-const ROOT = path.resolve(__dirname, '..');
-const BASH_SCRIPT = path.join(ROOT, 'scripts', 'clipboard-vision.sh');
-const POWERSHELL_SCRIPT = path.join(ROOT, 'scripts', 'clipboard-vision.ps1');
-const SECRET = 'cv-secret-must-never-leak';
-
-function writeExecutable(file, content) {
-  fs.writeFileSync(file, content, { mode: 0o755 });
-}
-
-function createFixture() {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'clipboard-vision-test-'));
-  const bin = path.join(root, 'bin');
-  const temp = path.join(root, 'temp');
-  fs.mkdirSync(bin);
-  fs.mkdirSync(temp);
-  const image = path.join(root, 'clipboard.png');
-  fs.writeFileSync(image, Buffer.from('89504e470d0a1a0a', 'hex'));
-  const clipboardCount = path.join(root, 'clipboard-count');
-  const curlCount = path.join(root, 'curl-count');
-  const curlArgs = path.join(root, 'curl-args');
-  const curlBody = path.join(root, 'curl-body');
-
-  writeExecutable(path.join(bin, 'pngpaste'), `#!/usr/bin/env bash
-set -euo pipefail
-printf x >> "${clipboardCount}"
-cp "${image}" "$1"
-`);
-  writeExecutable(path.join(bin, 'curl'), `#!/usr/bin/env bash
-set -euo pipefail
-printf x >> "${curlCount}"
-printf '%s\n' "$@" > "${curlArgs}"
-while [ "$#" -gt 0 ]; do
-  if [ "$1" = '--data-binary' ]; then cp "\${2#@}" "${curlBody}"; shift 2; continue; fi
-  if [ "$1" = '--output' ]; then output="$2"; shift 2; continue; fi
-  if [ "$1" = '--write-out' ]; then shift 2; continue; fi
-  shift
-done
-if [ -n "\${CV_FAKE_RESPONSE:-}" ]; then
-  printf '%s' "$CV_FAKE_RESPONSE" > "$output"
-else
-  printf '%s' '{"choices":[{"message":{"content":"described safely"}}]}' > "$output"
-fi
-printf '%s' "\${CV_FAKE_STATUS:-200}"
-`);
-
-  return { root, bin, temp, image, clipboardCount, curlCount, curlArgs, curlBody };
-}
-
-function run(fixture, args = [], env = {}) {
-  return spawnSync('bash', [BASH_SCRIPT, ...args], {
-    encoding: 'utf8',
-    env: {
-      ...process.env,
-      PATH: `${fixture.bin}:${process.env.PATH}`,
-      TMPDIR: fixture.temp,
-      CLIPBOARD_VISION_MODEL: 'fixture-model',
-      CLIPBOARD_VISION_API_KEY: SECRET,
-      ...env,
-    },
-  });
-}
-
-function combined(result) {
-  return `${result.stdout}${result.stderr}`;
-}
-
-function count(file) {
-  return fs.existsSync(file) ? fs.readFileSync(file, 'utf8').length : 0;
-}
-
-function consentToken(hostname, model, base = `https://${hostname}/v1`) {
-  const url = new URL(base);
-  const scheme = url.protocol.slice(0, -1).toLowerCase();
-  const normalizedHost = url.hostname.toLowerCase();
-  const port = url.port || (scheme === 'https' ? '443' : '80');
-  const displayHost = normalizedHost.includes(':') ? `[${normalizedHost}]` : normalizedHost;
-  const endpoint = `${scheme}://${displayHost}:${port}${url.pathname.replace(/\/+$/, '')}/chat/completions`;
-  return crypto.createHash('sha256').update(`${endpoint}\n${model}`, 'utf8').digest('hex');
-}
-
-function assertNoTempFiles(fixture) {
-  expect(fs.readdirSync(fixture.temp)).toEqual([]);
-}
-
-describe('clipboard-vision Bash client', () => {
-  let fixture;
-
-  beforeEach(() => {
-    fixture = createFixture();
-  });
-
-  afterEach(() => {
-    fs.rmSync(fixture.root, { recursive: true, force: true });
-  });
-
-  it('fails without model configuration before reading clipboard or calling network', () => {
-    const result = run(fixture, [], { CLIPBOARD_VISION_MODEL: '' });
-
-    expect(result.status).not.toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('rejects a non-loopback endpoint in local mode before reading clipboard', () => {
-    const result = run(fixture, [], { CLIPBOARD_VISION_API_BASE: 'https://vision.example.test/v1' });
-
-    expect(result.status).not.toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('requires both remote opt-in and destination-bound confirmation', () => {
-    const endpoint = { CLIPBOARD_VISION_API_BASE: 'https://vision.example.test/v1' };
-    const optInOnly = run(fixture, ['--allow-remote'], endpoint);
-    const confirmationOnly = run(fixture, ['--confirm-remote', consentToken('vision.example.test', 'fixture-model')], endpoint);
-
-    expect(optInOnly.status).not.toBe(0);
-    expect(confirmationOnly.status).not.toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('prints disclosure and expected token before rejecting missing confirmation', () => {
-    const result = run(fixture, ['--allow-remote'], {
-      CLIPBOARD_VISION_API_BASE: 'https://vision.example.test/v1',
-    });
-
-    expect(result.status).not.toBe(0);
-    expect(result.stderr).toContain('vision.example.test');
-    expect(result.stderr).toContain('fixture-model');
-    expect(result.stderr.toLowerCase()).toContain('image');
-    expect(result.stderr).toContain(consentToken('vision.example.test', 'fixture-model'));
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('accepts the confirmation token bound to normalized hostname and exact model', () => {
-    const token = consentToken('vision.example.test', 'fixture-model');
-    const result = run(fixture, ['--allow-remote', '--confirm-remote', token], {
-      CLIPBOARD_VISION_API_BASE: 'https://VISION.Example.Test/v1',
-    });
-
-    expect(result.status, combined(result)).toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(1);
-    expect(count(fixture.curlCount)).toBe(1);
-  });
-
-  it('rejects a token for a changed destination before clipboard or network', () => {
-    const staleToken = consentToken('old.example.test', 'fixture-model');
-    const result = run(fixture, ['--allow-remote', '--confirm-remote', staleToken], {
-      CLIPBOARD_VISION_API_BASE: 'https://vision.example.test/v1',
-    });
-
-    expect(result.status).not.toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('rejects a token for a changed model before clipboard or network', () => {
-    const staleToken = consentToken('vision.example.test', 'old-model');
-    const result = run(fixture, ['--allow-remote', '--confirm-remote', staleToken], {
-      CLIPBOARD_VISION_API_BASE: 'https://vision.example.test/v1',
-    });
-
-    expect(result.status).not.toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-  });
-
-  it('never exposes the API key in output or request JSON', () => {
-    const result = run(fixture);
-
-    expect(result.status, combined(result)).toBe(0);
-    expect(combined(result)).not.toContain(SECRET);
-    expect(fs.readFileSync(fixture.curlBody, 'utf8')).not.toContain(SECRET);
-  });
-
-  it('rejects oversized clipboard images before network access', () => {
-    fs.writeFileSync(fixture.image, Buffer.alloc(33));
-    const result = run(fixture, [], { CLIPBOARD_VISION_MAX_BYTES: '32' });
-
-    expect(result.status).not.toBe(0);
-    expect(count(fixture.curlCount)).toBe(0);
-    assertNoTempFiles(fixture);
-  });
-
-  it('removes temporary files after success', () => {
-    const result = run(fixture);
-
-    expect(result.status, combined(result)).toBe(0);
-    expect(result.stdout.trim()).toBe('described safely');
-    assertNoTempFiles(fixture);
-  });
-
-  it('redacts API failure bodies and removes temporary files after failure', () => {
-    const response = `upstream body contains ${SECRET}`;
-    const result = run(fixture, [], { CV_FAKE_STATUS: '500', CV_FAKE_RESPONSE: response });
-
-    expect(result.status).not.toBe(0);
-    expect(combined(result)).not.toContain(response);
-    expect(combined(result)).not.toContain(SECRET);
-    assertNoTempFiles(fixture);
-  });
-
-  it('performs exactly one clipboard read and one request per explicit invocation', () => {
-    const result = run(fixture);
-
-    expect(result.status, combined(result)).toBe(0);
-    expect(count(fixture.clipboardCount)).toBe(1);
-    expect(count(fixture.curlCount)).toBe(1);
-  });
-});
-
-describe('clipboard-vision PowerShell contract', () => {
-  it('keeps credentials in the environment and enforces bound consent, bounds, and cleanup', () => {
-    const content = fs.readFileSync(POWERSHELL_SCRIPT, 'utf8');
-
-    expect(content).toMatch(/\$env:CLIPBOARD_VISION_API_KEY/);
-    expect(content).toMatch(/AllowRemote/);
-    expect(content).toMatch(/ConfirmRemote/);
-    expect(content).toMatch(/SHA256/i);
-    expect(content).toMatch(/CLIPBOARD_VISION_MAX_BYTES/);
-    expect(content).toMatch(/finally\s*\{/i);
-    expect(content).toMatch(/Remove-Item/);
-    expect(content).not.toMatch(/https:\/\/(?!127\.0\.0\.1|localhost|\[::1\])/);
-  });
-
-  it('disables HTTP redirects so loopback cannot forward the clipboard body remotely', () => {
-    const content = fs.readFileSync(POWERSHELL_SCRIPT, 'utf8');
-
-    expect(content).toMatch(/MaximumRedirection\s+0/);
-  });
-
-  it('validates an absolute HTTP(S) URI without credentials before disclosure or seams', () => {
-    const content = fs.readFileSync(POWERSHELL_SCRIPT, 'utf8');
-    const validationPosition = content.indexOf('IsAbsoluteUri');
-    const disclosurePosition = content.indexOf('Remote disclosure');
-    const clipboardPosition = content.indexOf('CLIPBOARD_VISION_TEST_IMAGE');
-
-    expect(validationPosition).toBeGreaterThan(0);
-    expect(content).toMatch(/Scheme[^\n]+https?/i);
-    expect(content).toMatch(/UserInfo/);
-    expect(validationPosition).toBeLessThan(disclosurePosition);
-    expect(validationPosition).toBeLessThan(clipboardPosition);
-  });
-
-  it('ships a discoverable Windows-CI executable behavior harness', () => {
-    expect(fs.existsSync(path.join(ROOT, '__tests__', 'clipboard-vision.Tests.ps1'))).toBe(true);
-  });
-
-  it('wires the discoverable PowerShell harness into windows-latest CI', () => {
-    let repoRoot = ROOT;
-    while (!fs.existsSync(path.join(repoRoot, '.github', 'workflows', 'cross-platform-ci.yml'))) {
-      repoRoot = path.dirname(repoRoot);
-    }
-    const workflow = fs.readFileSync(path.join(repoRoot, '.github', 'workflows', 'cross-platform-ci.yml'), 'utf8');
-
-    expect(workflow).toContain('windows-latest');
-    expect(workflow).toContain('clipboard-vision.Tests.ps1');
-    expect(workflow).toMatch(/shell:\s*pwsh/);
-  });
-});

package/plugins/qoder/skills/clipboard-vision/clipboard-vision/scripts/clipboard-vision.ps1

@@ -1,86 +0,0 @@
-[CmdletBinding()]
-param(
-    [switch]$AllowRemote,
-    [string]$ConfirmRemote
-)
-
-$ErrorActionPreference = 'Stop'
-$ApiBase = if ($env:CLIPBOARD_VISION_API_BASE) { $env:CLIPBOARD_VISION_API_BASE } else { 'http://127.0.0.1:11434/v1' }
-$Model = $env:CLIPBOARD_VISION_MODEL
-$ApiKey = $env:CLIPBOARD_VISION_API_KEY
-$MaxBytes = if ($env:CLIPBOARD_VISION_MAX_BYTES) { [long]$env:CLIPBOARD_VISION_MAX_BYTES } else { 10485760 }
-
-if (-not $Model) { throw 'CLIPBOARD_VISION_MODEL is required' }
-if ($MaxBytes -le 0) { throw 'CLIPBOARD_VISION_MAX_BYTES must be positive' }
-$Endpoint = $null
-if (-not [Uri]::TryCreate($ApiBase, [UriKind]::Absolute, [ref]$Endpoint) -or
-    -not $Endpoint.IsAbsoluteUri -or
-    $Endpoint.Scheme -notin @('http', 'https') -or
-    $Endpoint.UserInfo.Length -ne 0 -or
-    $Endpoint.Query.Length -ne 0 -or
-    $Endpoint.Fragment.Length -ne 0) {
-    throw 'CLIPBOARD_VISION_API_BASE must be an absolute HTTP(S) URI without credentials'
-}
-$Address = $null
-$LiteralAddress = [Net.IPAddress]::TryParse($Endpoint.Host.Trim('[', ']'), [ref]$Address)
-$Loopback = $LiteralAddress -and [Net.IPAddress]::IsLoopback($Address)
-$NormalizedHost = $Endpoint.Host.Trim('[', ']').ToLowerInvariant()
-$EffectivePort = if ($Endpoint.IsDefaultPort) { if ($Endpoint.Scheme -eq 'https') { 443 } else { 80 } } else { $Endpoint.Port }
-$DisplayHost = if ($NormalizedHost.Contains(':')) { "[$NormalizedHost]" } else { $NormalizedHost }
-$BasePath = $Endpoint.AbsolutePath.TrimEnd('/')
-$EffectiveEndpoint = "$($Endpoint.Scheme.ToLowerInvariant())://$DisplayHost`:$EffectivePort$BasePath/chat/completions"
-if (-not $Loopback) {
-    $ConsentBytes = [Text.Encoding]::UTF8.GetBytes("$EffectiveEndpoint`n$Model")
-    $Hasher = [Security.Cryptography.SHA256]::Create()
-    try { $ExpectedConfirmation = ([BitConverter]::ToString($Hasher.ComputeHash($ConsentBytes))).Replace('-', '').ToLowerInvariant() } finally { $Hasher.Dispose() }
-    [Console]::Error.WriteLine("Remote disclosure: clipboard image data will be sent to $EffectiveEndpoint using model $Model.")
-    [Console]::Error.WriteLine("Confirmation token for this canonical endpoint and model: $ExpectedConfirmation")
-    if (-not $AllowRemote -or $ConfirmRemote -cne $ExpectedConfirmation) {
-        throw 'Remote endpoint requires -AllowRemote and the disclosed -ConfirmRemote token'
-    }
-}
-
-$TempDirectory = Join-Path ([IO.Path]::GetTempPath()) ("clipboard-vision-" + [Guid]::NewGuid())
-$ImagePath = Join-Path $TempDirectory 'clipboard.png'
-try {
-    New-Item -ItemType Directory -Path $TempDirectory | Out-Null
-    if ($env:CLIPBOARD_VISION_TEST_IMAGE) {
-        Copy-Item -LiteralPath $env:CLIPBOARD_VISION_TEST_IMAGE -Destination $ImagePath
-    } else {
-        Add-Type -AssemblyName System.Windows.Forms
-        Add-Type -AssemblyName System.Drawing
-        $Image = [Windows.Forms.Clipboard]::GetImage()
-        if ($null -eq $Image) { throw 'Clipboard does not contain an image' }
-        try { $Image.Save($ImagePath, [Drawing.Imaging.ImageFormat]::Png) } finally { $Image.Dispose() }
-    }
-    if ((Get-Item $ImagePath).Length -gt $MaxBytes) { throw "Clipboard image exceeds $MaxBytes bytes" }
-
-    $Encoded = [Convert]::ToBase64String([IO.File]::ReadAllBytes($ImagePath))
-    $Body = @{
-        model = $Model
-        messages = @(@{ role = 'user'; content = @(
-            @{ type = 'text'; text = 'Describe this clipboard image.' },
-            @{ type = 'image_url'; image_url = @{ url = "data:image/png;base64,$Encoded" } }
-        ) })
-    } | ConvertTo-Json -Depth 8 -Compress
-    $Headers = @{}
-    if ($ApiKey) { $Headers.Authorization = "Bearer $ApiKey" }
-    try {
-        if ($env:CLIPBOARD_VISION_TEST_HTTP_CAPTURE) {
-            Set-Content -LiteralPath $env:CLIPBOARD_VISION_TEST_HTTP_CAPTURE -Value $Body -Encoding utf8
-            if ($env:CV_TEST_HTTP_FAILURE) { throw 'test HTTP failure body secret' }
-            if ($env:CV_TEST_MALFORMED_JSON) { $Response = $null }
-            elseif ($env:CV_TEST_NON_STRING) { $Response = @{ choices = @(@{ message = @{ content = @{ value = 1 } } }) } }
-            else { $Response = @{ choices = @(@{ message = @{ content = 'test description' } }) } }
-        } else {
-            $Response = Invoke-RestMethod -Method Post -Uri $EffectiveEndpoint -Headers $Headers -ContentType 'application/json' -Body $Body -MaximumRedirection 0
-        }
-    } catch {
-        throw 'Vision API request failed (response body redacted)'
-    }
-    $Result = $Response.choices[0].message.content
-    if ($Result -isnot [string]) { throw 'Invalid vision API response (body redacted)' }
-    $Result
-} finally {
-    Remove-Item -LiteralPath $TempDirectory -Recurse -Force -ErrorAction SilentlyContinue
-}

package/plugins/qoder/skills/clipboard-vision/clipboard-vision/scripts/clipboard-vision.sh

@@ -1,137 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-api_base="${CLIPBOARD_VISION_API_BASE:-http://127.0.0.1:11434/v1}"
-model="${CLIPBOARD_VISION_MODEL:-}"
-api_key="${CLIPBOARD_VISION_API_KEY:-}"
-max_bytes="${CLIPBOARD_VISION_MAX_BYTES:-10485760}"
-allow_remote=false
-confirm_remote=""
-while [ "$#" -gt 0 ]; do
-  case "$1" in
-    --allow-remote) allow_remote=true; shift ;;
-    --confirm-remote)
-      [ "$#" -ge 2 ] || { printf '%s\n' 'Error: --confirm-remote requires the disclosed token' >&2; exit 2; }
-      confirm_remote="$2"
-      shift 2
-      ;;
-    --help)
-      printf '%s\n' 'Usage: clipboard-vision.sh [--allow-remote --confirm-remote TOKEN]'
-      exit 0
-      ;;
-    *) printf 'Error: unknown option: %s\n' "$1" >&2; exit 2 ;;
-  esac
-done
-
-[ -n "$model" ] || { printf '%s\n' 'Error: CLIPBOARD_VISION_MODEL is required' >&2; exit 2; }
-case "$max_bytes" in *[!0-9]*|'') printf '%s\n' 'Error: CLIPBOARD_VISION_MAX_BYTES must be a positive integer' >&2; exit 2 ;; esac
-[ "$max_bytes" -gt 0 ] || { printf '%s\n' 'Error: CLIPBOARD_VISION_MAX_BYTES must be positive' >&2; exit 2; }
-
-endpoint_info=$(python3 - "$api_base" "$model" <<'PY'
-import hashlib
-import ipaddress
-import sys
-import urllib.parse
-
-url = urllib.parse.urlparse(sys.argv[1])
-if url.scheme not in {"http", "https"} or not url.hostname or url.username or url.password or url.query or url.fragment:
-    raise SystemExit(2)
-try:
-    loopback = ipaddress.ip_address(url.hostname).is_loopback
-except ValueError:
-    loopback = False
-try:
-    port = url.port or (443 if url.scheme == "https" else 80)
-except ValueError:
-    raise SystemExit(2)
-print("local" if loopback else "remote")
-hostname = url.hostname.lower()
-print(hostname)
-display_host = f"[{hostname}]" if ":" in hostname else hostname
-base_path = url.path.rstrip("/")
-effective = f"{url.scheme.lower()}://{display_host}:{port}{base_path}/chat/completions"
-print(effective)
-print(hashlib.sha256(f"{effective}\n{sys.argv[2]}".encode()).hexdigest())
-PY
-) || { printf '%s\n' 'Error: invalid CLIPBOARD_VISION_API_BASE' >&2; exit 2; }
-endpoint_kind=$(printf '%s\n' "$endpoint_info" | sed -n '1p')
-effective_endpoint=$(printf '%s\n' "$endpoint_info" | sed -n '3p')
-expected_confirmation=$(printf '%s\n' "$endpoint_info" | sed -n '4p')
-
-if [ "$endpoint_kind" = remote ]; then
-  printf 'Remote disclosure: clipboard image data will be sent to %s using model %s.\n' "$effective_endpoint" "$model" >&2
-  printf 'Confirmation token for this canonical endpoint and model: %s\n' "$expected_confirmation" >&2
-  if [ "$allow_remote" != true ] || [ "$confirm_remote" != "$expected_confirmation" ]; then
-    printf '%s\n' 'Error: remote endpoint requires --allow-remote and the disclosed --confirm-remote token' >&2
-    exit 2
-  fi
-fi
-
-work_dir=$(mktemp -d "${TMPDIR:-/tmp}/clipboard-vision.XXXXXX")
-image_file="$work_dir/clipboard.png"
-request_file="$work_dir/request.json"
-response_file="$work_dir/response.json"
-auth_file="$work_dir/auth-header"
-cleanup() { rm -rf -- "$work_dir"; }
-trap cleanup EXIT HUP INT TERM
-
-if command -v pngpaste >/dev/null 2>&1; then
-  pngpaste "$image_file"
-elif command -v wl-paste >/dev/null 2>&1; then
-  wl-paste --no-newline --type image/png > "$image_file"
-elif command -v import >/dev/null 2>&1; then
-  import clipboard: "$image_file"
-else
-  printf '%s\n' 'Error: install pngpaste, wl-paste, or ImageMagick import' >&2
-  exit 2
-fi
-
-[ -s "$image_file" ] || { printf '%s\n' 'Error: clipboard does not contain an image' >&2; exit 2; }
-image_bytes=$(wc -c < "$image_file" | tr -d '[:space:]')
-[ "$image_bytes" -le "$max_bytes" ] || { printf 'Error: clipboard image exceeds %s bytes\n' "$max_bytes" >&2; exit 2; }
-
-python3 - "$image_file" "$request_file" "$model" <<'PY'
-import base64
-import json
-import pathlib
-import sys
-
-image = base64.b64encode(pathlib.Path(sys.argv[1]).read_bytes()).decode("ascii")
-request = {
-    "model": sys.argv[3],
-    "messages": [{"role": "user", "content": [
-        {"type": "text", "text": "Describe this clipboard image."},
-        {"type": "image_url", "image_url": {"url": "data:image/png;base64," + image}},
-    ]}],
-}
-pathlib.Path(sys.argv[2]).write_text(json.dumps(request), encoding="utf-8")
-PY
-
-curl_args=(--silent --show-error --max-redirs 0 --output "$response_file" --write-out '%{http_code}' --header 'Content-Type: application/json' --data-binary "@$request_file")
-if [ -n "$api_key" ]; then
-  case "$api_key" in *$'\n'*|*$'\r'*) printf '%s\n' 'Error: invalid CLIPBOARD_VISION_API_KEY' >&2; exit 2 ;; esac
-  umask 077
-  printf 'Authorization: Bearer %s\n' "$api_key" > "$auth_file"
-  chmod 600 "$auth_file"
-  curl_args+=(--header "@$auth_file")
-fi
-status=$(curl "${curl_args[@]}" "$effective_endpoint") || { printf '%s\n' 'Error: vision API request failed' >&2; exit 1; }
-case "$status" in 2??) ;; *) printf 'Error: vision API returned HTTP %s (body redacted)\n' "$status" >&2; exit 1 ;; esac
-
-result=$(python3 - "$response_file" <<'PY'
-import json
-import pathlib
-import sys
-
-try:
-    data = json.loads(pathlib.Path(sys.argv[1]).read_text(encoding="utf-8"))
-    value = data["choices"][0]["message"]["content"]
-    if not isinstance(value, str):
-        raise ValueError
-except (KeyError, IndexError, TypeError, ValueError, json.JSONDecodeError):
-    raise SystemExit(2)
-print(value)
-PY
-) || { printf '%s\n' 'Error: invalid vision API response (body redacted)' >&2; exit 1; }
-
-printf '%s\n' "$result"

package/plugins/qoder/skills/ralph-loop/references/components/memory.md

@@ -1,55 +0,0 @@
-# memory.md — Ralph Loop 状态与记忆结构（AHE 组件分解）
-
-> **本文是 `skills/ralph-loop/SKILL.md` 中状态管理的 AHE 对齐展开。**
-
-## 组件职责
-
-定义 Ralph Loop 的进度持久化 Schema、learnings 分类结构。
-
-## Progress Log Schema (`progress.log` — YAML)
-
-```yaml
-req_progress:
-  completed_count: 3
-  total_count: 5
-  current_req: REQ-XXX-004
-  status: running|completed|blocked
-  test_infra_status: generated|existing|skipped|fallback
-
-learnings:
-  permanent:
-    - pattern: "描述持久模式"
-      evidence: "来源证据"
-  contextual:
-    - pattern: "描述当前 REQ 有效模式"
-      expires_on: "过期条件"
-
-cost:
-  req_number: 3
-  tokens_used: 15000
-  cumulative_tokens: 85000
-  threshold: 200000
-```
-
-## Test Infra Status 字段
-
-| 值 | 含义 |
-|---|------|
-| `generated` | 本 REQ 首次生成 test-utils.ts |
-| `existing` | test-utils.ts 已存在且接口完整 |
-| `skipped` | 非首次 REQ，跳过 test-infra 检查（缓存结果）|
-| `fallback` | test-infra dispatch 失败，使用 inline 生成（含 warning）|
-
-## Learnings 分类
-
-| 类型 | 生命周期 | 持久化 | 示例 |
-|------|---------|--------|------|
-| `permanent` | 跨所有 REQ | progress.log | "项目使用 ESLint strict 模式" |
-| `contextual` | 当前 REQ 内 | progress.log (过期标记) | "REQ 003 使用 Zod 验证 schema" |
-
-## AHE 分类
-
-| 字段 | 值 |
-|------|---|
-| 组件类型 | Long-Term Memory |
-| 修改频率预期 | 低 |

package/plugins/qoder/skills/ralph-loop/references/components/middleware.md

@@ -1,54 +0,0 @@
-# middleware.md — Ralph Loop 迭代控制逻辑（AHE 组件分解）
-
-> **本文是 `skills/ralph-loop/SKILL.md` 中迭代流程的 AHE 对齐展开。**
-
-## 组件职责
-
-定义 Ralph Loop 的状态机：REQ 级迭代控制、熔断机制、中断续传逻辑。
-
-## 状态机
-
-```
-REQ N → 加载 learnings → 测试基础设施检查 → [infra missing?] → test_infra_dispatch
-     │                              │                             │
-     │                              │ infra ready                 │ FAIL (max 2 retry)
-     │                              ▼                             ▼
-     │                         TDD → 回归测试 ←───────────── BLOCK/fallback
-     │                              │
-     │ PASS → REQ N+1
-     │ FAIL → 重试 (max 3) → BLOCK → 用户决策
-     │ ALL_REQS_COMPLETE → 结束，返回控制权给 sprint-flow orchestrator
-```
-
-## 测试基础设施状态机
-
-```
-test_infra_check → [needs infra?] → test_infra_dispatch → FAIL → retry (max 2)
-        │               │                        │                      │
-        │               │ infra ready            │ pass                 │ pass
-        ▼               ▼                        ▼                      ▼
-     in_progress   test_infra_ready ─────────→ TDD → regression     BLOCK/fallback
-```
-
-## 熔断机制
-
-| 触发条件 | 动作 |
-|---------|------|
-| TDD 失败 > 3 次 | BLOCK + 用户决策 |
-| Token 使用超阈值 | BLOCK + 用户决策 |
-| 回归测试失败 | 记录到 progress.log，通知 sprint-flow orchestrator |
-| test-infra dispatch 失败 (max 2 retry) | BLOCK 或 fallback inline 生成（记录 warning）|
-
-## 暂停点
-
-| 暂停点 | 触发条件 | 恢复 |
-|--------|---------|------|
-| REQ 完成 | 自动暂停等待确认 | 确认后继续下一个 REQ |
-| 熔断 | 自动触发 | 用户决策后继续或放弃 |
-
-## AHE 分类
-
-| 字段 | 值 |
-|------|---|
-| 组件类型 | Middleware |
-| 修改频率预期 | 高 |

package/plugins/qoder/skills/ralph-loop/references/components/skill-invocations.md

@@ -1,39 +0,0 @@
-# skill-invocations.md — Ralph Loop 技能调用（AHE 组件分解）
-
-> **本文是 `skills/ralph-loop/SKILL.md` 中技能调用链的 AHE 对齐展开。**
-
-## 组件职责
-
-提供 Ralph Loop 在每个 REQ 执行中的技能调用链。
-
-## 完整调用链
-
-| 步骤 | Skill | 来源 | 参数 |
-|------|-------|------|------|
-| 0 | 测试基础设施检查 | 内置 | 检查 test-utils.ts 存在性 + 接口契约（createTestApp, withTestDb）|
-| 1 | `test-driven-development` | superpowers | `--lang` 注入 + TDD 铁律 + Mock 边界（覆盖默认策略）|
-| 2 | `learn` | gstack | classification: permanent/contextual |
-| 3 | `requesting-code-review` | superpowers | REQ 完成后评审 |
-
-## test-infra dispatch 节点
-
-当 test-utils.ts 不存在或接口缺失时：
-
-```
-task(category="unspecified-high", load_skills=["test-driven-development"], prompt="生成测试基础设施：createTestApp() + withTestDb()。TDD 铁律：先写测试再实现。")
-```
-
-- retry max 2 次
-- 仍失败 → BLOCK 或 fallback inline 生成（记录 warning）
-- 成功后与业务代码合并为同一 commit
-
-## 上游依赖
-
-从 `specification.yaml` 获取 REQ 列表（由 `to-issues` skill 生成）
-
-## AHE 分类
-
-| 字段 | 值 |
-|------|---|
-| 组件类型 | Skill Invocation Chain |
-| 修改频率预期 | 中 |

package/plugins/qoder/skills/ralph-loop/references/components/system-prompt.md

@@ -1,24 +0,0 @@
-# system-prompt.md — Ralph Loop 行为定义（AHE 组件分解）
-
-> **本文是 `skills/ralph-loop/SKILL.md` 核心原则的 AHE 对齐展开。**
-
-## 核心职责
-
-定义 Ralph Loop (Phase 2 BUILD 默认模式) 的行为边界：逐 REQ/切片 迭代构建，每个 REQ dispatch 独立 subagent，干净上下文，全量回归测试。
-
-## 核心原则 (AHE 对齐)
-
-| # | 原则 | 说明 |
-|---|------|------|
-| 1 | 逐 REQ 迭代 | 一次处理一个 REQ/切片，干净上下文，避免上下文线性膨胀 |
-| 2 | Token 节约 | 比旧并行模式节约 40-67% token |
-| 3 | 全量回归 | 每个 REQ 完成后跑全量测试 |
-| 4 | 进度持久化 | progress.log 持久化 learnings/permanent/contextual |
-| 5 | 可中断续传 | 中断后可从最后完成 REQ 继续 |
-
-## AHE 分类
-
-| 字段 | 值 |
-|------|---|
-| 组件类型 | System Prompt |
-| 修改频率预期 | 低 |