@costrict/csc 4.2.27 → 4.2.29

package/dist/services/rawDump/batchWorker.js

@@ -736,8 +736,8 @@ function getClientVersion() {
   if (cached)
     return cached;
   try {
-    if ("4.2.27") {
-      cached = "4.2.27";
+    if ("4.2.29") {
+      cached = "4.2.29";
       return cached;
     }
   } catch {}
@@ -5600,6 +5600,7 @@ var init_cli = __esm(() => {
     "cli.option.appendSystemPrompt": "Append a system prompt to the default system prompt",
     "cli.option.appendSystemPromptFile": "Read system prompt from a file and append to the default system prompt",
     "cli.option.assistant": "Force assistant mode (Agent SDK daemon use)",
+    "cli.option.authProvider": "Authenticate fetches with the current CoStrict login. Only 'costrict' is supported; a URL served by your own CoStrict deployment is detected automatically.",
     "cli.option.authToken": "Bearer token for authentication",
     "cli.option.available": "Include available plugins from marketplaces",
     "cli.option.bare": "Minimal mode: skip hooks, LSP, plugin sync, attribution, auto-memory, background prefetches, keychain reads, and CLAUDE.md auto-discovery. Sets CLAUDE_CODE_SIMPLE=1. Anthropic auth is strictly ANTHROPIC_API_KEY or apiKeyHelper via --settings (OAuth and keychain are never read). 3P providers (Bedrock/Vertex/Foundry) use their own credentials. Skills still resolve via /skill-name. Explicitly provide context via: --system-prompt[-file], --append-system-prompt[-file], --add-dir (CLAUDE.md dirs), --mcp-config, --settings, --agents, --plugin-dir.",
@@ -5826,6 +5827,8 @@ Set it to the space-separated scopes the refresh token was issued with
     "cli.plugins.invalidMarketplaceSource": "Invalid marketplace source format. Try: owner/repo, https://..., or ./path",
     "cli.plugins.invalidScope": "Invalid scope '{scope}'. Use: user, project, or local",
     "cli.plugins.sparseNotSupported": "--sparse is only supported for github and git marketplace sources (got: {source})",
+    "cli.plugins.invalidAuthProvider": "Invalid auth provider '{provider}'. Only 'costrict' is supported.",
+    "cli.plugins.authProviderNotSupported": "--auth-provider is only supported for url marketplace sources (got: {source})",
     "cli.plugins.addingMarketplace": "Adding marketplace...",
     "cli.plugins.marketplaceAlreadyOnDisk": "Marketplace '{name}' already on disk \u2014 declared in {scope} settings",
     "cli.plugins.marketplaceAdded": "Successfully added marketplace: {name} (declared in {scope} settings)",
@@ -10148,6 +10151,7 @@ var init_cli2 = __esm(() => {
     "cli.option.appendSystemPrompt": "\u5411\u9ED8\u8BA4\u7CFB\u7EDF\u63D0\u793A\u8BCD\u8FFD\u52A0\u5185\u5BB9",
     "cli.option.appendSystemPromptFile": "\u4ECE\u6587\u4EF6\u8BFB\u53D6\u7CFB\u7EDF\u63D0\u793A\u8BCD\u5E76\u8FFD\u52A0\u5230\u9ED8\u8BA4\u7CFB\u7EDF\u63D0\u793A\u8BCD",
     "cli.option.assistant": "\u5F3A\u5236\u4F7F\u7528 assistant \u6A21\u5F0F\uFF08Agent SDK daemon \u4F7F\u7528\uFF09",
+    "cli.option.authProvider": "\u4F7F\u7528\u5F53\u524D CoStrict \u767B\u5F55\u6001\u8BA4\u8BC1\u5E02\u573A\u62C9\u53D6\u3002\u4EC5\u652F\u6301 'costrict'\uFF1B\u7531\u672C\u673A CoStrict \u90E8\u7F72\u63D0\u4F9B\u7684 URL \u4F1A\u81EA\u52A8\u8BC6\u522B\u3002",
     "cli.option.authToken": "\u7528\u4E8E\u8BA4\u8BC1\u7684 Bearer token",
     "cli.option.available": "\u5305\u542B\u5E02\u573A\u4E2D\u53EF\u7528\u7684\u63D2\u4EF6",
     "cli.option.bare": "\u7CBE\u7B80\u6A21\u5F0F\uFF1A\u8DF3\u8FC7 hooks\u3001LSP\u3001\u63D2\u4EF6\u540C\u6B65\u3001attribution\u3001\u81EA\u52A8\u8BB0\u5FC6\u3001\u540E\u53F0\u9884\u53D6\u3001keychain \u8BFB\u53D6\u548C CLAUDE.md \u81EA\u52A8\u53D1\u73B0\u3002\u8BBE\u7F6E CLAUDE_CODE_SIMPLE=1\u3002\u8BA4\u8BC1\u4E25\u683C\u4F7F\u7528 ANTHROPIC_API_KEY \u6216\u901A\u8FC7 --settings \u7684 apiKeyHelper\uFF08OAuth \u548C keychain \u4E0D\u4F1A\u88AB\u8BFB\u53D6\uFF09\u3002\u7B2C\u4E09\u65B9 provider\uFF08Bedrock/Vertex/Foundry\uFF09\u4F7F\u7528\u5404\u81EA\u7684\u51ED\u8BC1\u3002\u6280\u80FD\u4ECD\u901A\u8FC7 /skill-name \u89E3\u6790\u3002\u53EF\u901A\u8FC7\u4EE5\u4E0B\u65B9\u5F0F\u663E\u5F0F\u63D0\u4F9B\u4E0A\u4E0B\u6587\uFF1A--system-prompt[-file]\u3001--append-system-prompt[-file]\u3001--add-dir\uFF08CLAUDE.md \u76EE\u5F55\uFF09\u3001--mcp-config\u3001--settings\u3001--agents\u3001--plugin-dir\u3002",
@@ -10374,6 +10378,8 @@ detached \u5F15\u64CE\u6CA1\u6709\u7528\u4E8E\u4EA4\u4E92\u8F93\u5165\u7684\u7EC
     "cli.plugins.invalidMarketplaceSource": "\u65E0\u6548\u7684\u5E02\u573A\u6E90\u683C\u5F0F\u3002\u8BF7\u4F7F\u7528: owner/repo, https://..., \u6216 ./path",
     "cli.plugins.invalidScope": "\u65E0\u6548\u7684\u4F5C\u7528\u57DF '{scope}'\u3002\u8BF7\u4F7F\u7528: user, project \u6216 local",
     "cli.plugins.sparseNotSupported": "--sparse \u4EC5\u652F\u6301 github \u548C git \u5E02\u573A\u6E90\uFF08\u5F97\u5230\u7684\u662F: {source}\uFF09",
+    "cli.plugins.invalidAuthProvider": "\u65E0\u6548\u7684\u8BA4\u8BC1\u63D0\u4F9B\u65B9 '{provider}'\u3002\u4EC5\u652F\u6301 'costrict'\u3002",
+    "cli.plugins.authProviderNotSupported": "--auth-provider \u4EC5\u652F\u6301 url \u7C7B\u578B\u7684\u5E02\u573A\u6E90\uFF08\u5F97\u5230\u7684\u662F: {source}\uFF09",
     "cli.plugins.addingMarketplace": "\u6B63\u5728\u6DFB\u52A0\u5E02\u573A...",
     "cli.plugins.marketplaceAlreadyOnDisk": "\u5E02\u573A '{name}' \u5DF2\u5B58\u5728\u4E8E\u78C1\u76D8\u4E0A \u2014 \u5DF2\u5728 {scope} \u8BBE\u7F6E\u4E2D\u58F0\u660E",
     "cli.plugins.marketplaceAdded": "\u6210\u529F\u6DFB\u52A0\u5E02\u573A: {name}\uFF08\u5DF2\u5728 {scope} \u8BBE\u7F6E\u4E2D\u58F0\u660E\uFF09",
@@ -87604,7 +87610,7 @@ function isBlockedOfficialName(name) {
   }
   return BLOCKED_OFFICIAL_NAME_PATTERN.test(name);
 }
-var ALLOWED_OFFICIAL_MARKETPLACE_NAMES, NO_AUTO_UPDATE_OFFICIAL_MARKETPLACES, AUTO_UPDATE_THIRD_PARTY_MARKETPLACES, BLOCKED_OFFICIAL_NAME_PATTERN, NON_ASCII_PATTERN, RelativePath, RelativeJSONPath, McpbPath, RelativeMarkdownPath, RelativeCommandPath, MarketplaceNameSchema, PluginAuthorSchema, PluginManifestMetadataSchema, PluginHooksSchema, PluginManifestHooksSchema, CommandMetadataSchema, PluginManifestCommandsSchema, PluginManifestAgentsSchema, PluginManifestSkillsSchema, PluginManifestOutputStylesSchema, nonEmptyString, fileExtension, PluginManifestMcpServerSchema, PluginUserConfigOptionSchema, PluginManifestUserConfigSchema, PluginManifestChannelsSchema, LspServerConfigSchema, PluginManifestLspServerSchema, NpmPackageNameSchema, PluginManifestSettingsSchema, PluginManifestSchema, MarketplaceSourceSchema, gitSha, PluginSourceSchema, SettingsMarketplacePluginSchema, PluginMarketplaceEntrySchema, PluginMarketplaceSchema, PluginIdSchema, DEP_REF_REGEX, DependencyRefSchema, SettingsPluginEntrySchema, InstalledPluginSchema, InstalledPluginsFileSchemaV1, PluginScopeSchema, PluginInstallationEntrySchema, InstalledPluginsFileSchemaV2, InstalledPluginsFileSchema, KnownMarketplaceSchema, KnownMarketplacesFileSchema;
+var ALLOWED_OFFICIAL_MARKETPLACE_NAMES, NO_AUTO_UPDATE_OFFICIAL_MARKETPLACES, AUTO_UPDATE_THIRD_PARTY_MARKETPLACES, BLOCKED_OFFICIAL_NAME_PATTERN, NON_ASCII_PATTERN, RelativePath, RelativeJSONPath, McpbPath, RelativeMarkdownPath, RelativeCommandPath, MarketplaceNameSchema, PluginAuthorSchema, PluginManifestMetadataSchema, PluginHooksSchema, PluginManifestHooksSchema, CommandMetadataSchema, PluginManifestCommandsSchema, PluginManifestAgentsSchema, PluginManifestSkillsSchema, PluginManifestOutputStylesSchema, nonEmptyString, fileExtension, PluginManifestMcpServerSchema, PluginUserConfigOptionSchema, PluginManifestUserConfigSchema, PluginManifestChannelsSchema, LspServerConfigSchema, PluginManifestLspServerSchema, NpmPackageNameSchema, PluginManifestSettingsSchema, PluginManifestSchema, MarketplaceSourceSchema, gitSha, CoStrictAuthProviderSchema, PluginSourceSchema, SettingsMarketplacePluginSchema, PluginMarketplaceEntrySchema, PluginMarketplaceSchema, PluginIdSchema, DEP_REF_REGEX, DependencyRefSchema, SettingsPluginEntrySchema, InstalledPluginSchema, InstalledPluginsFileSchemaV1, PluginScopeSchema, PluginInstallationEntrySchema, InstalledPluginsFileSchemaV2, InstalledPluginsFileSchema, KnownMarketplaceSchema, KnownMarketplacesFileSchema;
 var init_schemas3 = __esm(() => {
   init_v4();
   init_hooks();
@@ -87811,6 +87817,7 @@ var init_schemas3 = __esm(() => {
     exports_external.object({
       source: exports_external.literal("url"),
       url: exports_external.string().url().describe("Direct URL to marketplace.json file"),
+      authProvider: exports_external.literal("costrict").optional().describe("Inject the current CoStrict OAuth token when fetching"),
       headers: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Custom HTTP headers (e.g., for authentication)")
     }),
     exports_external.object({
@@ -87857,6 +87864,7 @@ var init_schemas3 = __esm(() => {
     }).describe("Inline marketplace manifest defined directly in settings.json. " + "The reconciler writes a synthetic marketplace.json to the cache; " + "diffMarketplaces detects edits via isEqual on the stored source " + "(the plugins array is inside this object, so edits surface as sourceChanged).")
   ]));
   gitSha = lazySchema(() => exports_external.string().length(40).regex(/^[a-f0-9]{40}$/, "Must be a full 40-character lowercase git commit SHA"));
+  CoStrictAuthProviderSchema = lazySchema(() => exports_external.literal("costrict").optional().describe("Fetch this source with the current CoStrict identity (private sources only)"));
   PluginSourceSchema = lazySchema(() => exports_external.union([
     RelativePath().describe("Path to the plugin root, relative to the marketplace root (the directory containing .claude-plugin/, not .claude-plugin/ itself)"),
     exports_external.object({
@@ -87875,7 +87883,8 @@ var init_schemas3 = __esm(() => {
       source: exports_external.literal("url"),
       url: exports_external.string().describe("Full git repository URL (https:// or git@)"),
       ref: exports_external.string().optional().describe('Git branch or tag to use (e.g., "main", "v1.0.0"). Defaults to repository default branch.'),
-      sha: gitSha().optional().describe("Specific commit SHA to use")
+      sha: gitSha().optional().describe("Specific commit SHA to use"),
+      authProvider: CoStrictAuthProviderSchema()
     }),
     exports_external.object({
       source: exports_external.literal("github"),
@@ -87888,7 +87897,8 @@ var init_schemas3 = __esm(() => {
       url: exports_external.string().describe("Git repository: GitHub owner/repo shorthand, https://, or git@ URL"),
       path: exports_external.string().min(1).describe('Subdirectory within the repo containing the plugin (e.g., "tools/claude-plugin"). ' + "Cloned sparsely using partial clone (--filter=tree:0) to minimize bandwidth for monorepos."),
       ref: exports_external.string().optional().describe('Git branch or tag to use (e.g., "main", "v1.0.0"). Defaults to repository default branch.'),
-      sha: gitSha().optional().describe("Specific commit SHA to use")
+      sha: gitSha().optional().describe("Specific commit SHA to use"),
+      authProvider: CoStrictAuthProviderSchema()
     }).describe("Plugin located in a subdirectory of a larger repository (monorepo). " + "Only the specified subdirectory is materialized; the rest of the repo is not downloaded.")
   ]));
   SettingsMarketplacePluginSchema = lazySchema(() => exports_external.object({
@@ -87907,6 +87917,7 @@ var init_schemas3 = __esm(() => {
       message: 'Plugin name cannot contain spaces. Use kebab-case (e.g., "my-plugin")'
     }).describe("Unique identifier matching the plugin name"),
     source: PluginSourceSchema().describe("Where to fetch the plugin from"),
+    authProvider: CoStrictAuthProviderSchema(),
     category: exports_external.string().optional().describe('Category for organizing plugins (e.g., "productivity", "development")'),
     tags: exports_external.array(exports_external.string()).optional().describe("Tags for searchability and discovery"),
     strict: exports_external.boolean().optional().default(true).describe("Require the plugin manifest to be present in the plugin folder. If false, the marketplace entry provides the manifest.")
@@ -138559,7 +138570,7 @@ var init_user = __esm(() => {
       deviceId,
       sessionId: getSessionId(),
       email: getEmail(),
-      appVersion: "4.2.27",
+      appVersion: "4.2.29",
       platform: getHostPlatformForAnalytics(),
       organizationUuid,
       accountUuid,
@@ -138846,7 +138857,7 @@ var init_metadata = __esm(() => {
     "sed"
   ]);
   getVersionBase = memoize_default(() => {
-    const match = "4.2.27".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
+    const match = "4.2.29".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
     return match ? match[0] : undefined;
   });
   buildEnvContext = memoize_default(async () => {
@@ -138886,9 +138897,9 @@ var init_metadata = __esm(() => {
       isGithubAction: isEnvTruthy(process.env.GITHUB_ACTIONS),
       isClaudeCodeAction: isEnvTruthy(process.env.CLAUDE_CODE_ACTION),
       isClaudeAiAuth: isClaudeAISubscriber(),
-      version: "4.2.27",
+      version: "4.2.29",
       versionBase: getVersionBase(),
-      buildTime: "2026-08-13T08:38:48.650Z",
+      buildTime: "2026-08-24T01:42:34.935Z",
       deploymentEnvironment: env4.detectDeploymentEnvironment(),
       ...isEnvTruthy(process.env.GITHUB_ACTIONS) && {
         githubEventName: process.env.GITHUB_EVENT_NAME,
@@ -143226,5 +143237,5 @@ export {
   isParentHeartbeatValid
 };
 
-//# debugId=37609006F3D6B41264756E2164756E21
+//# debugId=ADEDB9641343B30B64756E2164756E21
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@costrict/csc",
-  "version": "4.2.27",
+  "version": "4.2.29",
   "description": "costrict",
   "type": "module",
   "author": "costrict",
@@ -36,7 +36,7 @@
     "scripts/postinstall.cjs",
     "scripts/run-parallel.mjs",
     "scripts/setup-chrome-mcp.mjs",
-    "scripts/install-cosknow.mjs"
+    "scripts/cleanup-cosknow.mjs"
   ],
   "scripts": {
     "build": "bun run build.ts",
@@ -74,7 +74,7 @@
     "test": "bun test",
     "check:unused": "knip-bun",
     "health": "bun run scripts/health-check.ts",
-    "postinstall": "node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs scripts/install-cosknow.mjs",
+    "postinstall": "node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs scripts/cleanup-cosknow.mjs",
     "docs:dev": "npx mintlify dev",
     "typecheck": "tsc --noEmit",
     "rcs": "bun run scripts/rcs.ts",

package/scripts/cleanup-cosknow.mjs

@@ -0,0 +1,150 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { readdir, rm } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+// 清理 csc postinstall 时期安装的 CosKnow kb 命令（v1 集成产物）。
+// 现在不再自动安装 cosknow，此脚本负责把历史遗留的文件移除。
+// 清理范围覆盖两个可能的 commands 目录：
+//   - ~/.claude/commands/    （v1 安装器当时的写入位置）
+//   - ~/.costrict/commands/  （品牌合规后的主配置目录）
+// 每个目录内的删除范围：
+//   1. .cosknow-manifest.json 中 files 列出的所有文件（权威依据）
+//   2. 兜底：commands 目录下所有 kb-*.md（manifest 缺失或未列出时）
+//   3. linter/kb-linter.js、prompts/ 子目录（v1 includeResources 复制产物）
+//   4. .cosknow-manifest.json 本身
+// 注意：不清理 ~/.costrict/cosknow/ 下的运行数据目录（statusline 等）。
+// 任何失败都是非致命的：warn 后 exit 0，绝不影响 csc 安装/更新。
+
+const MANIFEST_FILE = '.cosknow-manifest.json'
+const TARGET_DIRS = [
+  join(homedir(), '.claude', 'commands'),
+  join(homedir(), '.costrict', 'commands'),
+]
+
+function log(msg) {
+  console.log(`[cosknow-cleanup] ${msg}`)
+}
+
+function warn(msg) {
+  console.warn(`[cosknow-cleanup] ${msg}`)
+}
+
+// 1. 按 manifest 删除
+async function deleteFromManifest(commandsDir) {
+  const manifestPath = join(commandsDir, MANIFEST_FILE)
+  if (!existsSync(manifestPath)) {
+    return 0
+  }
+
+  let manifest
+  try {
+    manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+  } catch (e) {
+    warn(`invalid manifest at ${manifestPath}, skipping manifest-based cleanup: ${e.message}`)
+    return 0
+  }
+
+  let deleted = 0
+  for (const filePath of manifest.files ?? []) {
+    if (existsSync(filePath)) {
+      try {
+        await rm(filePath)
+        deleted++
+      } catch (e) {
+        warn(`failed to remove ${filePath}: ${e.message}`)
+      }
+    }
+  }
+  return deleted
+}
+
+// 2. 兜底：删除 commands 目录下所有 kb-*.md
+async function deleteKbCommands(commandsDir) {
+  let entries
+  try {
+    entries = await readdir(commandsDir)
+  } catch {
+    return 0 // commands 目录不存在，无需清理
+  }
+
+  let deleted = 0
+  for (const entry of entries) {
+    if (!entry.startsWith('kb-') || !entry.endsWith('.md')) {
+      continue
+    }
+    const filePath = join(commandsDir, entry)
+    try {
+      await rm(filePath)
+      deleted++
+    } catch (e) {
+      warn(`failed to remove ${filePath}: ${e.message}`)
+    }
+  }
+  return deleted
+}
+
+// 3. 删除 v1 复制到 commands/ 下的资源文件
+async function deleteResources(commandsDir) {
+  const linterPath = join(commandsDir, 'linter', 'kb-linter.js')
+  if (existsSync(linterPath)) {
+    try {
+      await rm(linterPath)
+      log(`removed ${linterPath}`)
+    } catch (e) {
+      warn(`failed to remove ${linterPath}: ${e.message}`)
+    }
+  }
+
+  // 若 linter/ 目录是 cosknow 创建的（删掉 kb-linter.js 后为空），一并移除
+  const linterDir = join(commandsDir, 'linter')
+  if (existsSync(linterDir)) {
+    try {
+      const remaining = await readdir(linterDir)
+      if (remaining.length === 0) {
+        await rm(linterDir, { recursive: true, force: true })
+        log(`removed empty dir ${linterDir}`)
+      }
+    } catch (e) {
+      warn(`failed to inspect ${linterDir}: ${e.message}`)
+    }
+  }
+
+  const promptsDir = join(commandsDir, 'prompts')
+  if (existsSync(promptsDir)) {
+    try {
+      await rm(promptsDir, { recursive: true, force: true })
+      log(`removed ${promptsDir}`)
+    } catch (e) {
+      warn(`failed to remove ${promptsDir}: ${e.message}`)
+    }
+  }
+}
+
+// 4. 删除 manifest 本身
+async function deleteManifest(commandsDir) {
+  const manifestPath = join(commandsDir, MANIFEST_FILE)
+  if (existsSync(manifestPath)) {
+    try {
+      await rm(manifestPath)
+      log(`removed ${manifestPath}`)
+    } catch (e) {
+      warn(`failed to remove ${manifestPath}: ${e.message}`)
+    }
+  }
+}
+
+let totalRemoved = 0
+
+for (const commandsDir of TARGET_DIRS) {
+  totalRemoved += await deleteFromManifest(commandsDir)
+  totalRemoved += await deleteKbCommands(commandsDir)
+  await deleteResources(commandsDir)
+  await deleteManifest(commandsDir)
+}
+
+if (totalRemoved > 0) {
+  log(`removed ${totalRemoved} CosKnow command file(s)`)
+} else {
+  log('no CosKnow commands found, nothing to clean')
+}

package/scripts/install-cosknow.mjs

@@ -1,34 +0,0 @@
-import { spawnSync, execSync } from 'node:child_process'
-import { join } from 'node:path'
-import { pathToFileURL } from 'node:url'
-
-// 全局安装最新版
-spawnSync('npm', ['install', '-g', '@costrict/cosknow@latest'], {
-  stdio: 'inherit',
-  shell: true,
-})
-
-// 获取全局 node_modules 路径
-let globalPrefix
-try {
-  globalPrefix = execSync('npm root -g', { encoding: 'utf8' }).trim()
-} catch {
-  console.warn('[cosknow] cannot determine global npm root, skipping')
-  process.exit(0)
-}
-
-let install
-try {
-  const mod = await import(pathToFileURL(join(globalPrefix, '@costrict', 'cosknow', 'dist', 'index.js')).href)
-  install = mod.install
-} catch {
-  console.warn('[cosknow] package not available, skipping command installation')
-  process.exit(0)
-}
-
-try {
-  await install({ target: 'claude-commands' })
-  console.log('[cosknow] commands installed to ~/.claude/commands/')
-} catch (e) {
-  console.warn('[cosknow] install failed (non-fatal):', e.message)
-}