@devcxl/opencode-cabbage 0.3.1 → 1.0.0

package/dist/plugin/setup-control.d.ts

@@ -0,0 +1,45 @@
+import { type CallerSessionClient } from "../kernel/caller.js";
+import { type SetupProbeReport } from "../kernel/setup.js";
+/** setup_control 工具依赖：项目目录 + caller 判定所需的 session client */
+export interface SetupControlDeps {
+    projectDir: string;
+    sessionClient: CallerSessionClient;
+}
+export type SetupControlResponse = {
+    ok: boolean;
+    readiness?: SetupProbeReport;
+    profileConfirmed?: boolean;
+    created?: string[];
+    prNumber?: number | null;
+    error?: {
+        code: string;
+        message: string;
+    };
+};
+/**
+ * setup_control 工具工厂（spec §2.3）。
+ * 三 op：probe（readiness 报告） / generate-workflows（缺失时生成草案 + Setup PR） / confirm-profile（Profile 写回 AGENTS.md）。
+ * caller：primary。server.ts 接线由后续批次统一处理（本批不注册，避免文件冲突）。
+ */
+export declare function createSetupControlTool(deps: SetupControlDeps): {
+    description: string;
+    args: {
+        op: import("zod").ZodEnum<{
+            probe: "probe";
+            "generate-workflows": "generate-workflows";
+            "confirm-profile": "confirm-profile";
+        }>;
+        pr_title: import("zod").ZodOptional<import("zod").ZodString>;
+        profile_overrides: import("zod").ZodOptional<import("zod").ZodString>;
+    };
+    execute(args: {
+        op: "probe" | "generate-workflows" | "confirm-profile";
+        pr_title?: string | undefined;
+        profile_overrides?: string | undefined;
+    }, context: import("@opencode-ai/plugin/tool").ToolContext): Promise<import("@opencode-ai/plugin/tool").ToolResult>;
+};
+/**
+ * 独立注册辅助：把 setup_control 挂到工具注册表。
+ * 供后续批次（批 8-11 或最终接线）在 server.ts 统一接线时调用。
+ */
+export declare function registerSetupControl(registry: Record<string, unknown>, deps: SetupControlDeps): void;

package/dist/plugin/setup-control.js

@@ -0,0 +1,80 @@
+import { tool } from "@opencode-ai/plugin/tool";
+import { requireCaller, CALLER_NOT_AUTHORIZED } from "../kernel/caller.js";
+import { probe, generateWorkflows, confirmProjectProfile, } from "../kernel/setup.js";
+const DEFAULT_PR_TITLE = "chore: add CI/release workflow drafts";
+/**
+ * setup_control 工具工厂（spec §2.3）。
+ * 三 op：probe（readiness 报告） / generate-workflows（缺失时生成草案 + Setup PR） / confirm-profile（Profile 写回 AGENTS.md）。
+ * caller：primary。server.ts 接线由后续批次统一处理（本批不注册，避免文件冲突）。
+ */
+export function createSetupControlTool(deps) {
+    return tool({
+        description: `Detect project setup readiness, generate missing CI/release workflow drafts, and confirm the project profile.
+
+Operations:
+- probe: Detect git/gh availability, AGENTS.md Profile, CI/release workflows, and branch protection. Returns a readiness report (development-ready / release-ready).
+- generate-workflows: Generate missing CI/release workflow drafts under .github/workflows/ (tech-stack agnostic), then create a chore/setup-workflows branch, commit, push, and open a Setup PR for manual merge.
+- confirm-profile: After user confirmation, write the Project Profile block (from profile_overrides) back to the root AGENTS.md.
+
+Caller: primary.`,
+        args: {
+            op: tool.schema.enum(["probe", "generate-workflows", "confirm-profile"]).describe("Setup operation"),
+            pr_title: tool.schema.string().optional().describe("PR title for generate-workflows"),
+            profile_overrides: tool.schema.string().optional().describe("JSON of user-confirmed profile fields for confirm-profile"),
+        },
+        async execute(args, ctx) {
+            const op = args.op;
+            const denied = await requireCaller(ctx, ["primary"], op, deps.sessionClient);
+            if (denied)
+                return errorResponse(CALLER_NOT_AUTHORIZED, denied);
+            try {
+                switch (op) {
+                    case "probe": {
+                        const readiness = await probe(deps.projectDir);
+                        return okResponse({ readiness });
+                    }
+                    case "generate-workflows": {
+                        const prTitle = args.pr_title ?? DEFAULT_PR_TITLE;
+                        const result = await generateWorkflows(deps.projectDir, { prTitle });
+                        if (!result.ok) {
+                            return errorResponse("SETUP_FAILED", result.error ?? "failed to generate workflows");
+                        }
+                        return okResponse({ created: result.created, prNumber: result.prNumber });
+                    }
+                    case "confirm-profile": {
+                        const overrides = args.profile_overrides;
+                        if (!overrides) {
+                            return errorResponse("POLICY_INVALID", "profile_overrides is required for confirm-profile");
+                        }
+                        const result = await confirmProjectProfile(deps.projectDir, overrides);
+                        if (!result.ok) {
+                            return errorResponse(result.code ?? "POLICY_INVALID", result.message ?? "failed to confirm profile");
+                        }
+                        return okResponse({ profileConfirmed: true });
+                    }
+                    default:
+                        return errorResponse("UNKNOWN_OP", `Unknown op: "${op}"`);
+                }
+            }
+            catch (err) {
+                return errorResponse("INTERNAL_ERROR", String(err));
+            }
+        },
+    });
+}
+/**
+ * 独立注册辅助：把 setup_control 挂到工具注册表。
+ * 供后续批次（批 8-11 或最终接线）在 server.ts 统一接线时调用。
+ */
+export function registerSetupControl(registry, deps) {
+    registry.setup_control = createSetupControlTool(deps);
+}
+function okResponse(overrides = {}) {
+    const resp = { ok: true, ...overrides };
+    return JSON.stringify(resp, null, 2);
+}
+function errorResponse(code, message) {
+    const resp = { ok: false, error: { code, message } };
+    return JSON.stringify(resp, null, 2);
+}
+//# sourceMappingURL=setup-control.js.map

package/dist/plugin/setup-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-control.js","sourceRoot":"","sources":["../../src/plugin/setup-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAA4B,MAAM,qBAAqB,CAAA;AACpG,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,qBAAqB,GAEtB,MAAM,oBAAoB,CAAA;AAiB3B,MAAM,gBAAgB,GAAG,uCAAuC,CAAA;AAEhE;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAsB;IAC3D,OAAO,IAAI,CAAC;QACV,WAAW,EAAE;;;;;;;iBAOA;QACb,IAAI,EAAE;YACJ,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACpG,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACrF,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;SACzH;QACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG;YACrB,MAAM,EAAE,GAAG,IAAI,CAAC,EAAY,CAAA;YAE5B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;YAC5E,IAAI,MAAM;gBAAE,OAAO,aAAa,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;YAE/D,IAAI,CAAC;gBACH,QAAQ,EAAE,EAAE,CAAC;oBACX,KAAK,OAAO,CAAC,CAAC,CAAC;wBACb,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;wBAC9C,OAAO,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;oBAClC,CAAC;oBACD,KAAK,oBAAoB,CAAC,CAAC,CAAC;wBAC1B,MAAM,OAAO,GAAI,IAAI,CAAC,QAA+B,IAAI,gBAAgB,CAAA;wBACzE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;wBACpE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;4BACf,OAAO,aAAa,CAAC,cAAc,EAAE,MAAM,CAAC,KAAK,IAAI,8BAA8B,CAAC,CAAA;wBACtF,CAAC;wBACD,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;oBAC3E,CAAC;oBACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;wBACvB,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAuC,CAAA;wBAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;4BACf,OAAO,aAAa,CAAC,gBAAgB,EAAE,mDAAmD,CAAC,CAAA;wBAC7F,CAAC;wBACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;wBACtE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;4BACf,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,gBAAgB,EAAE,MAAM,CAAC,OAAO,IAAI,2BAA2B,CAAC,CAAA;wBACtG,CAAC;wBACD,OAAO,UAAU,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAA;oBAC/C,CAAC;oBACD;wBACE,OAAO,aAAa,CAAC,YAAY,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAA;gBAC7D,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,aAAa,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;YACrD,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAiC,EAAE,IAAsB;IAC5F,QAAQ,CAAC,aAAa,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,YAA2C,EAAE;IAC/D,MAAM,IAAI,GAAyB,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,SAAS,EAAE,CAAA;IAC7D,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe;IAClD,MAAM,IAAI,GAAyB,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAA;IAC1E,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;AACtC,CAAC"}

package/dist/plugin/shell.d.ts

@@ -1,37 +1,10 @@
-import type { AgentEntry } from "./agents.js";
-export interface AmbientCredentialSource {
-    source: string;
-    /** "env" | "config_file" | "credential_helper" */
-    kind: "env" | "config_file" | "credential_helper";
-    /** 具体位置（如 "GH_TOKEN" 或 "~/.config/gh/hosts.yml"） */
-    location: string;
-}
-export interface AmbientCredentialReport {
-    hasWriteCredentials: boolean;
-    hasGitCredentialHelper: boolean;
-    sources: AmbientCredentialSource[];
-}
 /**
- * 检测宿主环境中的 GitHub 写凭证。
+ * 为 Agent 生成 shell 环境变量。
  *
- * 检查内容：
- * - GH_TOKEN / GITHUB_TOKEN / GH_ENTERPRISE_TOKEN 环境变量
- * - ~/.config/gh/hosts.yml（GitHub CLI OAuth token）
- * - ~/.gitconfig 中的 credential helper
- *
- * 注意：这只能检测常见模式，不是完备的安全审计。
- */
-export declare function detectAmbientCredentials(): AmbientCredentialReport;
-/**
- * 为 Worker agent 创建隔离 shell 环境变量。
- *
- * 隔离措施：
- * - HOME 设为临时目录（避免访问宿主 ~/.ssh, ~/.gitconfig 等）
- * - GH_CONFIG_DIR 设为临时目录下的隔离路径
- * - GH_TOKEN / GITHUB_TOKEN 显式清空
- * - GIT_CONFIG_PARAMETERS 不传递（避免继承宿主 git config）
- *
- * 重要：shell.env 只作为附加措施，不作为唯一隔离边界。
- * 真正的权限控制来自 agent permission 字段 + ambient credential 检测。
+ * 复用宿主 gh auth：不再清空 GH_TOKEN/GITHUB_TOKEN、不替换 HOME/GH_CONFIG_DIR，
+ * Agent shell 内只读 gh/git 可用（PRD R4「模型可直接只读 git/gh」）。
+ * 安全边界：写操作凭据与模型 shell 共享宿主 auth，因此**写操作靠 permission 规则
+ * （deny 置尾、最后匹配优先、auto 模式 deny 生效）收敛到生命周期工具**，
+ * 而非依赖凭据隔离——见 spec §7.3 的取舍说明。
  */
-export declare function createIsolatedShellEnv(agent: AgentEntry): Record<string, string>;
+export declare function createAgentShellEnv(): Record<string, string>;

package/dist/plugin/shell.js

@@ -1,144 +1,19 @@
-import fs from "node:fs";
-import path from "node:path";
-import os from "node:os";
-// ─── 凭证检测 ───
-const GITHUB_WRITE_TOKEN_PATTERNS = [
-    /^ghp_/, // classic PAT
-    /^github_pat_/, // fine-grained PAT
-    /^gho_/, // OAuth token
-    /^ghu_/, // user-to-server token
-    /^ghs_/, // server-to-server token
-    /^ghr_/, // refresh token
-];
+// ─── Shell 环境 ───
 /**
- * 检测 token 值是否看起来是 GitHub 写凭证。
- */
-function looksLikeGithubToken(value) {
-    const trimmed = value.trim();
-    if (!trimmed)
-        return false;
-    return GITHUB_WRITE_TOKEN_PATTERNS.some(p => p.test(trimmed));
-}
-/**
- * 检测环境变量中的 GitHub API 凭证。
- */
-function detectEnvTokens() {
-    const sources = [];
-    const keys = ["GH_TOKEN", "GITHUB_TOKEN", "GH_ENTERPRISE_TOKEN"];
-    for (const key of keys) {
-        const value = process.env[key];
-        if (value && looksLikeGithubToken(value)) {
-            sources.push({
-                source: key,
-                kind: "env",
-                location: `$${key}`,
-            });
-        }
-    }
-    return sources;
-}
-/**
- * 检测 ~/.config/gh/hosts.yml 中的 oauth_token。
- */
-function detectGhHostsConfig() {
-    const sources = [];
-    const home = process.env.HOME || os.homedir();
-    const hostsPath = path.join(home, ".config", "gh", "hosts.yml");
-    try {
-        if (!fs.existsSync(hostsPath))
-            return sources;
-        const content = fs.readFileSync(hostsPath, "utf8");
-        // 简单检测 oauth_token 字段
-        if (/oauth_token\s*:\s*\S+/.test(content)) {
-            sources.push({
-                source: "gh_hosts_config",
-                kind: "config_file",
-                location: hostsPath,
-            });
-        }
-    }
-    catch {
-        // 读取失败时静默忽略
-    }
-    return sources;
-}
-/**
- * 检测 git credential helper 配置。
- * 检查 ~/.gitconfig 中是否配置了 credential.helper。
- */
-function detectGitCredentialHelper() {
-    const sources = [];
-    const home = process.env.HOME || os.homedir();
-    const gitconfigPath = path.join(home, ".gitconfig");
-    let hasHelper = false;
-    try {
-        if (!fs.existsSync(gitconfigPath))
-            return { hasHelper, sources };
-        const content = fs.readFileSync(gitconfigPath, "utf8");
-        if (/credential\s*\]\s*\n\s*helper\s*=/.test(content) || /\[credential\s+"[^"]*"\]/.test(content)) {
-            hasHelper = true;
-            sources.push({
-                source: "git_credential_helper",
-                kind: "credential_helper",
-                location: gitconfigPath,
-            });
-        }
-    }
-    catch {
-        // 读取失败静默忽略
-    }
-    return { hasHelper, sources };
-}
-/**
- * 检测宿主环境中的 GitHub 写凭证。
- *
- * 检查内容：
- * - GH_TOKEN / GITHUB_TOKEN / GH_ENTERPRISE_TOKEN 环境变量
- * - ~/.config/gh/hosts.yml（GitHub CLI OAuth token）
- * - ~/.gitconfig 中的 credential helper
+ * 为 Agent 生成 shell 环境变量。
  *
- * 注意：这只能检测常见模式，不是完备的安全审计。
+ * 复用宿主 gh auth：不再清空 GH_TOKEN/GITHUB_TOKEN、不替换 HOME/GH_CONFIG_DIR，
+ * Agent shell 内只读 gh/git 可用（PRD R4「模型可直接只读 git/gh」）。
+ * 安全边界：写操作凭据与模型 shell 共享宿主 auth，因此**写操作靠 permission 规则
+ * （deny 置尾、最后匹配优先、auto 模式 deny 生效）收敛到生命周期工具**，
+ * 而非依赖凭据隔离——见 spec §7.3 的取舍说明。
  */
-export function detectAmbientCredentials() {
-    const envSources = detectEnvTokens();
-    const ghConfigSources = detectGhHostsConfig();
-    const { hasHelper, sources: helperSources } = detectGitCredentialHelper();
-    const allSources = [...envSources, ...ghConfigSources, ...helperSources];
-    const hasWriteCredentials = allSources.length > 0;
+export function createAgentShellEnv() {
     return {
-        hasWriteCredentials,
-        hasGitCredentialHelper: hasHelper,
-        sources: allSources,
-    };
-}
-// ─── Shell 隔离 ───
-/**
- * 为 Worker agent 创建隔离 shell 环境变量。
- *
- * 隔离措施：
- * - HOME 设为临时目录（避免访问宿主 ~/.ssh, ~/.gitconfig 等）
- * - GH_CONFIG_DIR 设为临时目录下的隔离路径
- * - GH_TOKEN / GITHUB_TOKEN 显式清空
- * - GIT_CONFIG_PARAMETERS 不传递（避免继承宿主 git config）
- *
- * 重要：shell.env 只作为附加措施，不作为唯一隔离边界。
- * 真正的权限控制来自 agent permission 字段 + ambient credential 检测。
- */
-export function createIsolatedShellEnv(agent) {
-    const shellHome = fs.mkdtempSync(path.join(os.tmpdir(), "cabbage-shell-"));
-    const ghConfigDir = path.join(shellHome, ".config", "gh");
-    fs.mkdirSync(ghConfigDir, { recursive: true });
-    const env = {
-        HOME: shellHome,
-        GH_CONFIG_DIR: ghConfigDir,
+        // 防系统 gitconfig 干扰
+        GIT_CONFIG_NOSYSTEM: "1",
+        // 禁止交互式凭据提示（失败即失败，不挂起等待输入）
+        GIT_TERMINAL_PROMPT: "0",
     };
-    // 清除所有 GitHub API token 环境变量
-    // shell.env 是附加措施 — 主要隔离由 agent permission 提供
-    env.GH_TOKEN = "";
-    env.GITHUB_TOKEN = "";
-    env.GH_ENTERPRISE_TOKEN = "";
-    // 不传递宿主 git config（隔离 HOME 已处理此问题，但显式清空更安全）
-    env.GIT_CONFIG_NOSYSTEM = "1";
-    return env;
 }
 //# sourceMappingURL=shell.js.map

package/dist/plugin/shell.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/plugin/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,MAAM,SAAS,CAAA;AAmBxB,eAAe;AAEf,MAAM,2BAA2B,GAAG;IAClC,OAAO,EAAS,cAAc;IAC9B,cAAc,EAAE,mBAAmB;IACnC,OAAO,EAAS,cAAc;IAC9B,OAAO,EAAS,uBAAuB;IACvC,OAAO,EAAS,yBAAyB;IACzC,OAAO,EAAS,gBAAgB;CACjC,CAAA;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1B,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AAC/D,CAAC;AAED;;GAEG;AACH,SAAS,eAAe;IACtB,MAAM,OAAO,GAA8B,EAAE,CAAA;IAC7C,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAA;IAEhE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,IAAI,GAAG,EAAE;aACpB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB;IAC1B,MAAM,OAAO,GAA8B,EAAE,CAAA;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;IAE/D,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,OAAO,CAAA;QAE7C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAClD,sBAAsB;QACtB,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,iBAAiB;gBACzB,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,yBAAyB;IAChC,MAAM,OAAO,GAA8B,EAAE,CAAA;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;IAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IAEnD,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;QAEhE,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClG,SAAS,GAAG,IAAI,CAAA;YAChB,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,uBAAuB;gBAC/B,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,aAAa;aACxB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,WAAW;IACb,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AAC/B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,UAAU,GAAG,eAAe,EAAE,CAAA;IACpC,MAAM,eAAe,GAAG,mBAAmB,EAAE,CAAA;IAC7C,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,yBAAyB,EAAE,CAAA;IAEzE,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,eAAe,EAAE,GAAG,aAAa,CAAC,CAAA;IACxE,MAAM,mBAAmB,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAA;IAEjD,OAAO;QACL,mBAAmB;QACnB,sBAAsB,EAAE,SAAS;QACjC,OAAO,EAAE,UAAU;KACpB,CAAA;AACH,CAAC;AAED,mBAAmB;AAEnB;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAiB;IACtD,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAA;IAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IACzD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE9C,MAAM,GAAG,GAA2B;QAClC,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,WAAW;KAC3B,CAAA;IAED,6BAA6B;IAC7B,8CAA8C;IAC9C,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAA;IACjB,GAAG,CAAC,YAAY,GAAG,EAAE,CAAA;IACrB,GAAG,CAAC,mBAAmB,GAAG,EAAE,CAAA;IAE5B,4CAA4C;IAC5C,GAAG,CAAC,mBAAmB,GAAG,GAAG,CAAA;IAE7B,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/plugin/shell.ts"],"names":[],"mappings":"AAAA,mBAAmB;AAEnB;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,mBAAmB;QACnB,mBAAmB,EAAE,GAAG;QACxB,2BAA2B;QAC3B,mBAAmB,EAAE,GAAG;KACzB,CAAA;AACH,CAAC"}

package/dist/plugin/skills.d.ts

@@ -1 +1 @@
-export declare function setupSkillsDir(sourceSkillsDir: string, contextDir?: string, promptsDir?: string): Promise<string>;
+export declare function setupSkillsDir(sourceSkillsDir: string, promptsDir?: string): Promise<string>;

package/dist/plugin/skills.js

@@ -1,23 +1,22 @@
-import { cp, mkdtemp, readdir, readFile, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
+import { cp, mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
 import path from "node:path";
-const _tempDirs = new Set();
-process.once("exit", () => {
-    for (const dir of _tempDirs) {
-        rm(dir, { recursive: true, force: true }).catch(() => { });
+/**
+ * skills 固定安装路径，确保跨会话稳定。
+ * 用 env CABBAGE_SKILLS_DIR 可覆盖，方便测试。
+ */
+function resolveSkillsPath() {
+    if (process.env.CABBAGE_SKILLS_DIR) {
+        return process.env.CABBAGE_SKILLS_DIR;
     }
-});
-export async function setupSkillsDir(sourceSkillsDir, contextDir, promptsDir) {
-    const baseDir = await mkdtemp(path.join(tmpdir(), "opencode-cabbage-skills-"));
-    _tempDirs.add(baseDir);
-    const destDir = path.join(baseDir, "skills");
+    return path.join(homedir(), ".config", "opencode", "cabbage", "skills");
+}
+export async function setupSkillsDir(sourceSkillsDir, promptsDir) {
+    const destDir = resolveSkillsPath();
+    // 清理旧内容，确保与插件版本一致
+    await rm(destDir, { recursive: true, force: true });
+    await mkdir(destDir, { recursive: true });
     await cp(sourceSkillsDir, destDir, { recursive: true });
-    if (contextDir) {
-        try {
-            await cp(contextDir, path.join(destDir, "_context"), { recursive: true });
-        }
-        catch { }
-    }
     if (promptsDir) {
         try {
             await cp(promptsDir, path.join(destDir, "_prompts"), { recursive: true });

package/dist/plugin/skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/plugin/skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;AAEnC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;IACxB,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC3D,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,eAAuB,EAAE,UAAmB,EAAE,UAAmB;IACpG,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAA;IAC9E,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACtB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAE5C,MAAM,EAAE,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEvD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3E,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3E,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,GAAW;QACnC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;YAC3C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;gBAC1B,SAAQ;YACV,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC9B,IAAI,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;gBAC9C,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,OAAO,GAAG,CAAC,CAAA;gBAChE,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,UAAU,CAAC,OAAO,CAAC,CAAA;IAEzB,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/plugin/skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B;;;GAGG;AACH,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAA;IACvC,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,eAAuB,EAAE,UAAmB;IAC/E,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAA;IAEnC,kBAAkB;IAClB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEzC,MAAM,EAAE,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEvD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3E,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,GAAW;QACnC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;YAC3C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;gBAC1B,SAAQ;YACV,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC9B,IAAI,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;gBAC9C,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,OAAO,GAAG,CAAC,CAAA;gBAChE,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,UAAU,CAAC,OAAO,CAAC,CAAA;IAEzB,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/plugin/task-control.d.ts

@@ -0,0 +1,90 @@
+/** task_control 工具依赖 */
+export interface TaskControlDeps {
+    projectDir: string;
+    sessionClient: {
+        session: {
+            get(input: {
+                sessionID: string;
+            }): Promise<{
+                data?: {
+                    parentID?: string | null;
+                };
+            }>;
+        };
+    };
+}
+export type TaskControlResponse = {
+    ok: boolean;
+    task?: {
+        parentIssueNumber?: number;
+        taskId?: string;
+        issueNumber?: number;
+    };
+    issueNumber?: number;
+    branch?: string;
+    worktreePath?: string;
+    policy?: unknown;
+    baseline?: unknown;
+    prNumber?: number;
+    evidenceRevision?: number;
+    verdict?: string;
+    risk?: string;
+    warning?: string;
+    reason?: string;
+    report?: unknown;
+    missing?: string[];
+    error?: {
+        code: string;
+        message: string;
+    };
+};
+/**
+ * task_control 工具工厂（spec §2.3）。
+ * caller 门禁：primary 全量；developer 拒绝（无门禁绕过面）。
+ */
+export declare function createTaskControlTool(deps: TaskControlDeps): {
+    description: string;
+    args: {
+        op: import("zod").ZodEnum<{
+            "create-task": "create-task";
+            "start-task": "start-task";
+            "submit-task": "submit-task";
+            "submit-review": "submit-review";
+            "merge-task": "merge-task";
+            "cancel-task": "cancel-task";
+            "destroy-worktree": "destroy-worktree";
+            "status-task": "status-task";
+        }>;
+        title: import("zod").ZodOptional<import("zod").ZodString>;
+        parent_issue_number: import("zod").ZodOptional<import("zod").ZodNumber>;
+        task_id: import("zod").ZodOptional<import("zod").ZodString>;
+        acceptance_criteria: import("zod").ZodOptional<import("zod").ZodString>;
+        depends_on: import("zod").ZodOptional<import("zod").ZodString>;
+        pr_number: import("zod").ZodOptional<import("zod").ZodNumber>;
+        risk: import("zod").ZodOptional<import("zod").ZodEnum<{
+            low: "low";
+            high: "high";
+        }>>;
+        verdict: import("zod").ZodOptional<import("zod").ZodEnum<{
+            approve: "approve";
+            "request-changes": "request-changes";
+        }>>;
+        comment: import("zod").ZodOptional<import("zod").ZodString>;
+        user_confirmed: import("zod").ZodOptional<import("zod").ZodBoolean>;
+    };
+    execute(args: {
+        op: "create-task" | "start-task" | "submit-task" | "submit-review" | "merge-task" | "cancel-task" | "destroy-worktree" | "status-task";
+        title?: string | undefined;
+        parent_issue_number?: number | undefined;
+        task_id?: string | undefined;
+        acceptance_criteria?: string | undefined;
+        depends_on?: string | undefined;
+        pr_number?: number | undefined;
+        risk?: "low" | "high" | undefined;
+        verdict?: "approve" | "request-changes" | undefined;
+        comment?: string | undefined;
+        user_confirmed?: boolean | undefined;
+    }, context: import("@opencode-ai/plugin/tool").ToolContext): Promise<import("@opencode-ai/plugin/tool").ToolResult>;
+};
+/** 独立注册辅助：把 task_control 挂到工具注册表（后续接线批次使用） */
+export declare function registerTaskControl(registry: Record<string, unknown>, deps: TaskControlDeps): void;