@jeffusion/tianshu 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jeffusion
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,76 @@
-# Temporary Holding Version
+# 天枢 Tianshu
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![CI](https://github.com/jeffusion/tianshu/actions/workflows/ci.yml/badge.svg)](https://github.com/jeffusion/tianshu/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+面向长期目标的智能协作工作台，以 Codex 本地插件交付。天枢将任务台账、执行聊天和验收证据连接起来，让跨聊天工作有持续的状态和明确的授权边界。
+
+**当前阶段：0.1.0，早期开发。** 已实现任务中心、MCP 工具和协调 Skill；完整自主规划、后台常驻执行和多客户端协作尚未实现。
+
+## 已实现
+
+- 按项目、状态、名称查看任务、授权范围与验收记录。
+- “带到聊天”仅添加任务背景；通过 `@天枢` 的自然语言请求查询、协调、核验或删除已结束任务。
+- SQLite 事务台账、revision 冲突保护、派发去重与不确定回执记录。
+- 删除任务保留独立验收归档；聊天空闲、回合结束和业务验收分别记录。
+- 明暗主题、只读浏览器预览、隔离测试与内容哈希构建标识。
+
+## npm 安装（正式渠道）
+
+```sh
+npm install -g @jeffusion/tianshu
+tianshu install
+tianshu doctor
+```
+
+命令安装后即可使用，无需克隆和构建源码；仍需本机 Node.js 24–26、Python 3.12+ 与 Codex CLI。npm 安装没有 postinstall 副作用，显式运行 install 才配置 Codex。安装后重开客户端、启用天枢并发送“@天枢 打开任务中心”。
+
+已有台账使用 `tianshu install --config /absolute/path/to/config.json`，不会搬动或清空数据。升级命令、回滚与卸载见 [npm 分发说明](docs/npm-distribution.md)。安装标识 `tianshu@tianshu`，市场显示名“天枢”，Skill 为 `tianshu:coordinator`，MCP 服务名 `tianshu`。
+
+源码克隆、npm ci、npm run demo 仅供开发测试。构建和测试不会更新当前 Codex 安装，也不会发布 npm 版本。
+
+## 工作方式与边界
+
+天枢提供 `open_workspace`、`list_tasks`、`get_task` 和 `delete_task`。工具本身不向其他聊天发消息；协调 Skill 使用宿主提供的聊天工具，按用户授权跟进工作。台账记录授权但不是权限系统，不能替代用户指令。
+
+删除仅接受已验收或已停止的任务，要求最新 revision、授权来源和必要的执行停止证据。删除不等于停止进程或监控。交付报告先进入待验收状态，经独立核验才接受。
+
+## 开发测试体验
+
+需要 Node.js 24 或 26、npm、Python 3.12+。Codex 插件宿主目前主要在 macOS 桌面客户端验证；CI 覆盖 Linux/macOS 的构建与隔离测试。
+
+```sh
+git clone https://github.com/jeffusion/tianshu.git
+cd tianshu
+npm ci
+npm run demo
+```
+
+打开 <http://127.0.0.1:8975/preview.html?theme=light>。演示仅生成 `.local/demo/` 内的独立任务，不读取你的真实台账、不安装插件、不发送聊天消息。预览中的附件操作被隔离，需要实际宿主验证。
+
+## 检查与构建
+
+```sh
+npm run check
+npm run build
+```
+
+`check` 包含 TypeScript、生产构建、Node 协议测试、Python 台账测试和真实 npm 包生命周期测试，无需 API key、模型服务或业务数据库。构建产物位于 `dist/plugin` 和 `dist/marketplace`，`dist/build-info.json` 包含内容指纹。版本保持 `0.1.0`；本地测试不递增版本，不自动生成 ZIP、创建 release 或发布 npm。
+
+## 工程结构
+
+| 目录 | 内容 |
+| --- | --- |
+| `src/ui` | React 任务中心与宿主桥接 |
+| `src/mcp` | MCP 工具与页面资源 |
+| `src/contracts` | 产品元数据、任务和附件契约 |
+| `ledger` | 配置解析、只读投影、事务台账 |
+| `skills/coordinator` | 跨聊天协调规则与命令参考 |
+| `scripts` | 演示、开发、构建、本地同步 |
+| `tests` | 独立 fixture 和回归测试 |
+
+参见[开发与验证](docs/development.md)、[贡献指南](CONTRIBUTING.md)、[安全说明](SECURITY.md)。私人配置、任务数据库、历史验收材料和安装产物不进入仓库。
+
+## 许可证
+
+[MIT](LICENSE)。第三方依赖保留各自许可证。本项目不隶属于 OpenAI；Codex、ChatGPT 等名称属于各自权利人。

package/bin/tianshu.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import {main} from '../cli/main.mjs';
+main().catch(error=>{console.error(JSON.stringify({ok:false,error:error.message}));process.exitCode=1;});

package/cli/main.mjs

@@ -0,0 +1,193 @@
+import {existsSync,readFileSync,writeFileSync,mkdirSync,cpSync,renameSync,rmSync,readdirSync,lstatSync,realpathSync} from 'node:fs';
+import {resolve,join,dirname,relative,isAbsolute} from 'node:path';
+import {homedir} from 'node:os';
+import {fileURLToPath} from 'node:url';
+import {execFileSync,spawn} from 'node:child_process';
+import {createHash,randomUUID} from 'node:crypto';
+import {probe} from './probe.mjs';
+const packageRoot=fileURLToPath(new URL('../',import.meta.url));
+const pkg=JSON.parse(readFileSync(join(packageRoot,'package.json'),'utf8'));
+const read=p=>JSON.parse(readFileSync(p,'utf8'));
+const print=value=>console.log(JSON.stringify(value,null,2));
+const help=`天枢 Tianshu ${pkg.version}\n\n  tianshu init                  初始化独立台账（已有配置不覆盖）\n  tianshu install               将已编译插件安装到 Codex\n  tianshu doctor                检查依赖、配置和已安装 MCP\n  tianshu upgrade               将当前 npm 包同步到插件，保留上一份\n  tianshu rollback              恢复上一份插件/未完成安装，保留台账\n  tianshu uninstall             移除 Codex 插件和市场，保留用户数据\n\n选项：--config <绝对路径>，--help，--version\n环境：TIANSHU_HOME、TIANSHU_PYTHON、TIANSHU_CODEX、CODEX_HOME\n安装 npm 包不会自动修改 Codex。需要 Node.js 24–26、Python 3.12+、Codex CLI。`;
+
+function atomic(path,value){const temp=path+'.'+randomUUID()+'.tmp';writeFileSync(temp,JSON.stringify(value,null,2)+'\n',{mode:0o600,flag:'wx'});renameSync(temp,path);}
+function run(command,args,options={}){return execFileSync(command,args,{encoding:'utf8',timeout:30000,maxBuffer:4*1024*1024,stdio:['pipe','pipe','pipe'],env:{...process.env,PYTHONDONTWRITEBYTECODE:'1'},...options});}
+function canonical(path){const value=resolve(path);return existsSync(value)?realpathSync(value):value;}
+function defaultHome(){return process.platform==='darwin'?join(homedir(),'Library/Application Support/Tianshu'):join(process.env.XDG_DATA_HOME||join(homedir(),'.local/share'),'tianshu');}
+function environment(options){
+  const requestedHome=resolve(process.env.TIANSHU_HOME||defaultHome());
+  if(existsSync(requestedHome)&&lstatSync(requestedHome).isSymbolicLink())throw new Error('TIANSHU_HOME must not be a symbolic link');
+  const home=canonical(requestedHome);
+  const codexHome=canonical(process.env.CODEX_HOME||join(homedir(),'.codex'));
+  const context={home,codexHome,codex:process.env.TIANSHU_CODEX||'codex',python:process.env.TIANSHU_PYTHON||'python3',statePath:join(home,'installation.json'),journal:join(home,'operation.json'),market:join(home,'marketplace'),active:join(home,'marketplace/plugins/tianshu')};
+  if(existsSync(home)&&lstatSync(home).isSymbolicLink())throw new Error('TIANSHU_HOME must not be a symbolic link');
+  const state=existsSync(context.statePath)?read(context.statePath):null;
+  if(state&&(state.schema!==1||state.codex_home!==codexHome))throw new Error('Installation state belongs to a different CODEX_HOME or unsupported schema');
+  context.state=state;
+  const selected=options.config||process.env.TIANSHU_CONFIG||state?.config||join(home,'config.json');
+  if(!isAbsolute(selected))throw new Error('Config path must be absolute');
+  context.config=selected;context.explicitConfig=Boolean(options.config||process.env.TIANSHU_CONFIG);
+  return context;
+}
+function owned(c,path){
+  const rel=relative(c.home,path);if(!rel||rel.startsWith('..')||isAbsolute(rel))throw new Error('Refusing operation outside managed home');
+  let current=c.home;
+  for(const part of rel.split(/[\\/]/)){current=join(current,part);if(existsSync(current)&&lstatSync(current).isSymbolicLink())throw new Error('Managed path must not contain symbolic links');}
+  return path;
+}
+function stateWrite(c,state){owned(c,c.statePath);if(state)atomic(c.statePath,state);else rmSync(c.statePath,{force:true});}
+function preflight(c,needCodex=true){
+  if(process.platform==='win32')throw new Error('This release supports macOS/Linux; Windows installation is not validated');
+  const node=Number(process.versions.node.split('.')[0]);if(node<24||node>26)throw new Error('Node.js 24–26 is required');
+  const python=JSON.parse(run(c.python,['-c','import sys,json;print(json.dumps({"version":list(sys.version_info[:2]),"path":sys.executable}))']));
+  if(python.version[0]!==3||python.version[1]<12)throw new Error('Python 3.12+ is required');c.python=python.path;
+  if(needCodex)run(c.codex,['--version'],{env:{...process.env,CODEX_HOME:c.codexHome}});
+}
+function codex(c,args){return JSON.parse(run(c.codex,args,{env:{...process.env,CODEX_HOME:c.codexHome}}));}
+function registeredMarket(c){const result=codex(c,['plugin','marketplace','list','--json']);const list=Array.isArray(result)?result:result.marketplaces;if(!Array.isArray(list))throw new Error('Unsupported Codex marketplace listing');return list.find(m=>m.name==='tianshu')||null;}
+function register(c,path){
+  if(registeredMarket(c))codex(c,['plugin','marketplace','remove','tianshu','--json']);
+  codex(c,['plugin','marketplace','add',path,'--json']);
+  const result=codex(c,['plugin','add','tianshu@tianshu','--json']);
+  return result.installedPath;
+}
+function verifyBundle(plugin,manifest){
+  if(lstatSync(plugin).isSymbolicLink())throw new Error('Plugin root must not be a symlink');
+  const actual=[];
+  function walk(dir){for(const e of readdirSync(dir,{withFileTypes:true})){const p=join(dir,e.name);if(e.isSymbolicLink())throw new Error('Plugin payload contains symlinks');if(e.isDirectory())walk(p);else if(e.isFile())actual.push(relative(plugin,p).split('\\').join('/'));else throw new Error('Unsupported payload entry');}}
+  walk(plugin);const expected=Object.keys(manifest.files||{}).sort();
+  if(!expected.length||JSON.stringify(actual.sort())!==JSON.stringify(expected))throw new Error('Plugin payload inventory mismatch');
+  for(const path of expected){if(isAbsolute(path)||path.split(/[\\/]/).includes('..'))throw new Error('Invalid integrity path');const hash=createHash('sha256').update(readFileSync(join(plugin,path))).digest('hex');if(hash!==manifest.files[path])throw new Error('Plugin integrity check failed: '+path);}
+  const info=read(join(plugin,'build-info.json'));
+  if(info.name!=='tianshu'||!/^[0-9a-f]{20}$/.test(info.build_id)||!/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/.test(info.version))throw new Error('Invalid plugin identity');
+  return info;
+}
+function archive(c){
+  const source=join(packageRoot,'dist/plugin'),integrity=read(join(packageRoot,'dist/build-info.json'));
+  const info=verifyBundle(source,integrity),id=info.version+'-'+info.build_id;
+  const directory=owned(c,join(c.home,'releases',id));mkdirSync(owned(c,join(c.home,'releases')),{recursive:true,mode:0o700});
+  if(!existsSync(directory)){
+    const stage=owned(c,join(c.home,'releases','.stage-'+randomUUID()));mkdirSync(stage,{mode:0o700});
+    try{cpSync(source,join(stage,'plugin'),{recursive:true});atomic(join(stage,'integrity.json'),integrity);renameSync(stage,directory);}finally{rmSync(stage,{recursive:true,force:true});}
+  }
+  if(JSON.stringify(read(join(directory,'integrity.json')).files)!==JSON.stringify(integrity.files))throw new Error('Build identity collision; existing release was preserved');
+  verifyBundle(owned(c,join(directory,'plugin')),read(owned(c,join(directory,'integrity.json'))));
+  return {id,directory,info};
+}
+function previousRelease(c,id){
+  if(!/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?-[0-9a-f]{20}$/.test(id||''))throw new Error('No previous managed plugin is available');
+  const directory=owned(c,join(c.home,'releases',id)),info=verifyBundle(owned(c,join(directory,'plugin')),read(owned(c,join(directory,'integrity.json'))));
+  return {id,directory,info};
+}
+function validateConfig(c){
+  const result=JSON.parse(run(c.python,[join(packageRoot,'dist/plugin/ledger/read_ledger.py'),'--config',c.config]));
+  if(!result.sources?.length||result.sources.some(s=>!s.ok))throw new Error('Configured ledger is missing or unhealthy; no replacement database was created');
+  return result;
+}
+function initialize(c){
+  if(existsSync(c.config)){validateConfig(c);return false;}
+  if(c.explicitConfig)throw new Error('Explicit config does not exist; configure an existing ledger or run init without --config');
+  const data=owned(c,join(c.home,'data'));mkdirSync(data,{recursive:true,mode:0o700});
+  const db=owned(c,join(data,'coordinator.db'));
+  if(!existsSync(db))run(c.python,[join(packageRoot,'dist/plugin/ledger/coordinator.py'),'--db',db,'init']);
+  const temp=owned(c,join(c.home,'.config-'+randomUUID()+'.json'));
+  const config={sources:[{id:'daily',label:'日常任务',path:db}]};
+  try{atomic(temp,config);const candidate={...c,config:temp};validateConfig(candidate);writeFileSync(owned(c,c.config),JSON.stringify(config,null,2)+'\n',{flag:'wx',mode:0o600});}finally{rmSync(temp,{force:true});}
+  return true;
+}
+function marketplaceFile(c){
+  mkdirSync(owned(c,join(c.market,'.agents/plugins')),{recursive:true,mode:0o700});
+  atomic(join(c.market,'.agents/plugins/marketplace.json'),{name:'tianshu',interface:{displayName:'天枢'},plugins:[{name:'tianshu',source:{source:'local',path:'./plugins/tianshu'},policy:{installation:'AVAILABLE',authentication:'ON_INSTALL'},category:'Productivity'}]});
+}
+async function recover(c){
+  const journal=read(owned(c,c.journal));
+  if(journal.codex_home!==c.codexHome||!/^\.backup-[0-9a-f-]+$/.test(journal.backup))throw new Error('Invalid recovery record');
+  const backup=owned(c,join(c.home,journal.backup));
+  if(existsSync(backup)){rmSync(owned(c,c.active),{recursive:true,force:true});mkdirSync(dirname(c.active),{recursive:true});renameSync(backup,c.active);}
+  else if(!journal.had_active)rmSync(owned(c,c.active),{recursive:true,force:true});
+  if(journal.before_market){register(c,journal.before_market);}
+  else{codex(c,['plugin','remove','tianshu@tianshu','--json']);if(registeredMarket(c))codex(c,['plugin','marketplace','remove','tianshu','--json']);}
+  stateWrite(c,journal.before_state);rmSync(c.journal);return {recovered:true,data_preserved:true};
+}
+async function install(c,release){
+  const beforeMarket=registeredMarket(c);
+  if(beforeMarket&&canonical(beforeMarket.root)!==canonical(c.market)&&!c.explicitConfig&&!c.state)throw new Error('An existing Tianshu installation was found. Use --config with its existing configuration to preserve tasks.');
+  initialize(c);validateConfig(c);
+  const stage=owned(c,join(c.home,'.stage-'+randomUUID())),backup='.backup-'+randomUUID(),backupPath=owned(c,join(c.home,backup));
+  mkdirSync(stage,{mode:0o700});
+  try{
+    cpSync(join(release.directory,'plugin'),stage,{recursive:true});
+    atomic(join(stage,'runtime-config.json'),{config_path:c.config});
+    const cache=join(c.codexHome,'plugins/cache/tianshu/tianshu',release.info.version);
+    atomic(join(stage,'.mcp.json'),{mcpServers:{tianshu:{command:process.execPath,args:[join(cache,'dist/server.mjs')],env:{TIANSHU_PYTHON:c.python,TIANSHU_CONFIG:c.config,PYTHONDONTWRITEBYTECODE:'1'}}}});
+    await probe(join(stage,'dist/server.mjs'),c.python,c.config);
+    const journal={codex_home:c.codexHome,backup,had_active:existsSync(c.active),before_state:c.state,before_market:beforeMarket?.root||null};
+    atomic(owned(c,c.journal),journal);
+    try{
+      mkdirSync(owned(c,dirname(c.active)),{recursive:true,mode:0o700});
+      if(journal.had_active)renameSync(c.active,backupPath);renameSync(stage,c.active);marketplaceFile(c);
+      const installed=register(c,c.market);if(!installed||canonical(installed)!==canonical(cache))throw new Error('Unexpected Codex installed path: '+installed);
+      const health=await probe(join(cache,'dist/server.mjs'),c.python,c.config);
+      if(health.build?.build_id!==release.info.build_id)throw new Error('Installed build does not match requested build');
+      const previous=c.state?.active===release.id?c.state.previous:c.state?.active||null;
+      stateWrite(c,{schema:1,codex_home:c.codexHome,active:release.id,previous,config:c.config,installed:true,installed_at:new Date().toISOString(),adopted_marketplace:c.state?.adopted_marketplace||(beforeMarket?.root!==c.market?beforeMarket?.root:null)});
+      rmSync(c.journal);rmSync(backupPath,{recursive:true,force:true});
+      return {installed:true,plugin:'tianshu@tianshu',...release.info,health,data_preserved:true,reload_client:true};
+    }catch(error){
+      try{await recover(c);}catch{throw new Error('Install failed and recovery is incomplete. Run tianshu rollback after checking Codex availability; user data was preserved.');}
+      throw new Error('Install failed; previous plugin restored: '+error.message);
+    }
+  }finally{rmSync(stage,{recursive:true,force:true});}
+}
+async function lock(c){
+  mkdirSync(c.home,{recursive:true,mode:0o700});const path=owned(c,join(c.home,'lifecycle.lock'));
+  // Kernel flock is released on exit/crash. Never unlink the stable lock inode.
+  const code='import os,sys,fcntl; fd=os.open(sys.argv[1],os.O_CREAT|os.O_RDWR|os.O_NOFOLLOW,0o600); fcntl.flock(fd,fcntl.LOCK_EX|fcntl.LOCK_NB); print("LOCKED",flush=True); sys.stdin.buffer.read()';
+  const child=spawn(c.python,['-c',code,path],{stdio:['pipe','pipe','pipe']});child.stderr.resume();
+  await new Promise((resolve,reject)=>{
+    const timer=setTimeout(()=>{child.kill();reject(new Error('Lifecycle lock timed out'));},5000);
+    child.once('error',error=>{clearTimeout(timer);reject(error);});
+    child.stdout.once('data',data=>{clearTimeout(timer);data.toString().trim()==='LOCKED'?resolve():reject(new Error('Lifecycle lock failed'));});
+    child.once('exit',()=>{clearTimeout(timer);reject(new Error('Another lifecycle operation is running or lock acquisition failed'));});
+  });
+  return ()=>new Promise(resolve=>{const timer=setTimeout(()=>child.kill('SIGKILL'),1000);child.once('close',()=>{clearTimeout(timer);resolve();});child.stdin.end();});
+}
+
+export async function main(argv=process.argv.slice(2)){
+  if(!argv.length||argv.includes('--help'))return console.log(help);
+  if(argv.length===1&&argv[0]==='--version')return console.log(pkg.version);
+  const command=argv.shift(),options={};
+  for(let i=0;i<argv.length;i++){if(argv[i]==='--config'&&argv[i+1])options.config=argv[++i];else throw new Error('Unknown option: '+argv[i]);}
+  if(!['init','install','upgrade','rollback','uninstall','doctor'].includes(command))throw new Error('Unknown command: '+command);
+  const c=environment(options);preflight(c,command!=='init');
+  if(command==='doctor'){
+    if(existsSync(c.journal))throw new Error('An interrupted lifecycle operation requires tianshu rollback');
+    if(!c.state?.installed)throw new Error('Plugin is not installed by this CLI; run tianshu install');
+    validateConfig(c);const release=previousRelease(c,c.state.active),cache=join(c.codexHome,'plugins/cache/tianshu/tianshu',release.info.version);
+    const market=registeredMarket(c);if(!market||canonical(market.root)!==canonical(c.market))throw new Error('Codex marketplace does not match this installation');
+    const health=await probe(join(cache,'dist/server.mjs'),c.python,c.config);if(health.build?.build_id!==release.info.build_id)throw new Error('Installed build drift detected');
+    return print({ok:true,home:c.home,config:c.config,health,host_ui_verified:false});
+  }
+  if(command==='install')mkdirSync(c.codexHome,{recursive:true,mode:0o700});
+  const unlock=await lock(c);
+  try{
+    // Re-read mutable installation state only after acquiring the lifecycle lock.
+    const python=c.python;Object.assign(c,environment(options),{python});
+    if(existsSync(c.journal)){if(command!=='rollback')throw new Error('An interrupted operation requires tianshu rollback');return print(await recover(c));}
+    if(command==='init'){initialize(c);return print({initialized:true,config:c.config});}
+    if(command==='uninstall'){
+      const market=registeredMarket(c);if(market&&canonical(market.root)!==canonical(c.market))throw new Error('Refusing to remove an installation managed elsewhere');
+      if(market&&!c.state?.installed)throw new Error('Managed installation state is missing or inconsistent; reinstall before uninstalling');
+      if(c.state?.installed){
+        atomic(owned(c,c.journal),{codex_home:c.codexHome,backup:'.backup-'+randomUUID(),had_active:existsSync(c.active),before_state:c.state,before_market:market?.root||null});
+        try{codex(c,['plugin','remove','tianshu@tianshu','--json']);if(market)codex(c,['plugin','marketplace','remove','tianshu','--json']);stateWrite(c,{...c.state,installed:false});rmSync(c.journal);}
+        catch(error){try{await recover(c);}catch{throw new Error('Uninstall recovery is incomplete; run tianshu rollback. User data was preserved.');}throw new Error('Uninstall failed; previous plugin restored: '+error.message);}
+      }
+      return print({uninstalled:true,data_preserved:true,home:c.home});
+    }
+    if(command==='upgrade'&&!c.state?.installed)throw new Error('No managed installation; run tianshu install first');
+    const release=command==='rollback'?previousRelease(c,c.state?.previous):archive(c);
+    return print(await install(c,release));
+  }finally{await unlock();}
+}

package/cli/probe.mjs

@@ -0,0 +1,37 @@
+import {spawn} from 'node:child_process';
+
+// Exercise the shipped server over stdio without SDK dependencies or host UI actions.
+export function probe(server,python,config){
+  return new Promise((resolve,reject)=>{
+    const child=spawn(process.execPath,[server],{env:{...process.env,TIANSHU_PYTHON:python,TIANSHU_CONFIG:config,PYTHONDONTWRITEBYTECODE:'1'},stdio:['pipe','pipe','pipe']});
+    let buffer='',bytes=0,finished=false;
+    const timer=setTimeout(()=>finish(new Error('MCP health check timed out')),12000);
+    function finish(error,value){if(finished)return;finished=true;clearTimeout(timer);child.kill();const force=setTimeout(()=>child.kill('SIGKILL'),1000);force.unref();child.once('close',()=>clearTimeout(force));error?reject(error):resolve(value);}
+    const send=value=>child.stdin.write(JSON.stringify(value)+'\n');
+    child.on('error',error=>finish(error));child.on('exit',()=>{if(!finished)finish(new Error('MCP server exited before health check completed'));});
+    child.stdin.on('error',error=>finish(error));child.stderr.resume();
+    child.stdout.on('data',chunk=>{
+      bytes+=chunk.length;if(bytes>4*1024*1024)return finish(new Error('MCP response exceeds health check limit'));
+      buffer+=chunk.toString();let newline;
+      while((newline=buffer.indexOf('\n'))>=0){
+        const line=buffer.slice(0,newline);buffer=buffer.slice(newline+1);if(!line.trim())continue;
+        try{
+          const response=JSON.parse(line);if(response.error)throw new Error('MCP health request rejected');
+          if(response.id===1){
+            if(response.result?.serverInfo?.name!=='tianshu')throw new Error('Unexpected MCP server identity');
+            send({jsonrpc:'2.0',method:'notifications/initialized'});send({jsonrpc:'2.0',id:2,method:'tools/list',params:{}});
+          }else if(response.id===2){
+            const tools=(response.result?.tools||[]).map(t=>t.name).sort();
+            if(JSON.stringify(tools)!==JSON.stringify(['delete_task','get_task','list_tasks','open_workspace']))throw new Error('Unexpected MCP tool inventory');
+            send({jsonrpc:'2.0',id:3,method:'tools/call',params:{name:'list_tasks',arguments:{}}});
+          }else if(response.id===3){
+            const data=response.result?.structuredContent;
+            if(response.result?.isError||!data?.readonly||!data.sources?.length||data.sources.some(s=>!s.ok))throw new Error('Configured ledger is not healthy/readable');
+            finish(null,{build:data.build,task_count:data.tasks.length,tools:4});
+          }
+        }catch(error){finish(error);}
+      }
+    });
+    send({jsonrpc:'2.0',id:1,method:'initialize',params:{protocolVersion:'2025-03-26',capabilities:{},clientInfo:{name:'tianshu-doctor',version:'0.1.0'}}});
+  });
+}

package/dist/build-info.json

@@ -0,0 +1,23 @@
+{
+  "name": "tianshu",
+  "version": "0.1.0",
+  "build_id": "c1a359e812cd60471640",
+  "files": {
+    ".codex-plugin/plugin.json": "641407767454849c99ac71830985099eb953b2cc15441518aa53634506ae5595",
+    ".mcp.json": "3ce62a0d6713492af210b08d178631c2fdf7289da73f3bcc18afb309b68d438f",
+    "THIRD_PARTY_NOTICES.txt": "2b1d9634bbbb03744bb91b6d5bf9acab2fb292b5dd88bfbb21940b692dae2dfb",
+    "build-info.json": "675fb07b1fd26d69040ca1f90354f0c74d69d5c6dd423cd22ba26ee22b4a17a1",
+    "dist/panel.html": "e50380e8d6ad8d9ca86c66a89c6878c943d17a84a3d7f7fc28a269d2a0527e72",
+    "dist/server.mjs": "044fb54532de96bfeebeb321dd1ac175fcb9dd399d36b735da49f1648259baa5",
+    "ledger/cli.py": "af7d889029aae5ee5b764dd0914ec8e0ef4e8dcdf27ef0dd0c66db8f86a5089d",
+    "ledger/config.py": "b3ed0c975ca744f00db5a142bb7feacb7c203455ef45822a6d8d3fcc6c01c377",
+    "ledger/coordinator.py": "839d685862f8f2879169295d616e74bbd0bf10c272b1f703ee72e24e27e630cf",
+    "ledger/read_ledger.py": "56f9c9d3ec9decb421e0cb6e89861c69bce2379de848353ea1e3656389cac885",
+    "skills/coordinator/SKILL.md": "30fcf652170692ecba39c9b306231bd581c918f9b939621b4a2cae4ca3418af5",
+    "skills/coordinator/agents/openai.yaml": "75d31a3b984c373e87f9846ad76051daf0370ee3a9ab275b171ab7c32061b15a",
+    "skills/coordinator/references/commands.md": "68b47788204dc5bcd725d65922c8f66a14191240a6bdedd0ecc0b227a7c54e15",
+    "skills/coordinator/references/recovery.md": "ec905ed9f28c5cb9eddd5a212b5a37bd96694faa7b8495596cc9e633dd0097c9",
+    "skills/coordinator/references/task-center.md": "7b4a7b12a2a13ca5fbc3519cd5483b8cbcc8619642c92876d59fda25297420c5",
+    "skills/coordinator/scripts/coordinator.py": "876861791b88f4a2b51540a6999687abc722b981a9ee5533495b6057a2592191"
+  }
+}

package/dist/plugin/.codex-plugin/plugin.json

@@ -0,0 +1,21 @@
+{
+  "name": "tianshu",
+  "version": "0.1.0",
+  "author": {
+    "name": "Jeffusion"
+  },
+  "description": "天枢：面向长期目标的智能协作工作台。",
+  "mcpServers": "./.mcp.json",
+  "interface": {
+    "displayName": "天枢",
+    "shortDescription": "面向目标的智能协作工作台",
+    "longDescription": "在天枢查看项目、任务与验收证据，将任务带到聊天；直接 @天枢 查询进度、推进、核验或删除已结束任务。",
+    "developerName": "Jeffusion",
+    "category": "Productivity",
+    "capabilities": [
+      "Read",
+      "Write"
+    ],
+    "defaultPrompt": "打开天枢任务中心。"
+  }
+}

package/dist/plugin/.mcp.json

@@ -0,0 +1,10 @@
+{
+  "mcpServers": {
+    "tianshu": {
+      "command": "node",
+      "args": [
+        "${PLUGIN_ROOT}/dist/server.mjs"
+      ]
+    }
+  }
+}