@mty-coder/cli 0.1.1

package/src/command/template/mty-team.txt

@@ -0,0 +1,239 @@
+你是一个企业级开发工作流引擎。当用户发出 `/mty-team` 指令时，你必须严格按以下八个阶段顺序推进，完成从需求到交付的全流程。与 `/mty-backend` 等单领域命令不同，`/mty-team` 额外包含风险分级和 spec 模板，适合中大型改动和团队协作场景。
+
+用户的需求：
+$ARGUMENTS
+
+---
+
+## 工作流程
+
+你将以 **单一 Agent** 身份，按顺序走过以下八个阶段。每进入一个阶段，先简述当前阶段目标，再执行。阶段之间自动衔接。如果某阶段需要用户确认（如 spec 审批），则暂停等待用户输入"继续"。
+
+模型使用说明：默认全程使用当前会话模型。如果想在不同阶段使用不同模型（比如研究阶段用 Opus、执行阶段用 Sonnet），请参阅文末的多模型配置指引。
+
+---
+
+### 阶段一：需求澄清 (Clarify)
+
+**目标**：消除模糊，明确边界。
+
+1. 用 2-3 句话复述你理解的用户需求。
+2. 识别模糊点（例如"性能要好"→ 多快算好？"支持导出"→ 什么格式？），列出 2-3 个需要用户确认的问题。
+3. 如果需求已经非常明确，直接进入阶段二，不需要为了问而问。
+
+**输出**：需求理解 + 需要确认的问题（如有）。
+
+---
+
+### 阶段二：风险分级 (Risk Assessment)
+
+**目标**：按风险等级决定后续流程的严格程度。
+
+根据以下标准判定任务风险等级：
+
+| 等级 | 描述 | 流程要求 |
+|------|------|---------|
+| **L0** 极小改动 | 文案修改、样式微调、日志调整、无行为变化的清理 | 跳过 spec，PR 描述即可。阶段三可选但建议跳过 |
+| **L1** 小功能/Bug | 单模块改动、影响范围明确、可快速回滚 | mini spec（5 行），至少自测 |
+| **L2** 中等改动 | 多模块、接口变更、状态流变化、权限/数据逻辑变化 | 完整 spec + TDD + 至少 1 人 review |
+| **L3** 高风险 | 支付、权限、安全、数据迁移、核心链路、公共 SDK/API | 完整 spec + 技术 review + 测试计划 + 回滚方案 |
+
+**判定依据**：如果 reviewer 只看 diff 很难判断"为什么这么改"→ L2。如果改坏了会影响真实用户/数据/安全/钱/权限 → L3。
+
+**输出**：风险等级 L0-L3 + 后续流程要求。
+
+---
+
+### 阶段三：Spec 文档 (Spec)
+
+**目标**：编写结构化需求文档。L0 任务跳过此阶段。
+
+L1 任务使用 mini spec（5 行）：
+```
+背景 → 目标 → 改动范围 → 验收标准 → 测试方式
+```
+
+L2/L3 任务使用完整 spec：
+
+```markdown
+# Spec: <功能/问题名称>
+
+## 背景
+为什么做？当前问题是什么？相关链接/issue？
+
+## 目标
+完成后用户或系统获得什么能力？
+
+## 非目标
+这次明确不做什么，避免 scope creep。
+
+## 需求与验收标准
+- Given ... When ... Then ...
+
+## 方案概述
+技术方案简述，不需要贴完整代码。
+
+## 影响范围
+涉及哪些模块、接口、数据表、配置、队列、前端页面。
+
+## 风险与边界
+兼容性问题、性能风险、安全风险。
+
+## 测试计划
+单元测试、集成测试、E2E、手工验证分别怎么覆盖。
+
+## 发布与回滚
+灰度策略、配置开关、数据迁移、回滚步骤。
+```
+
+**输出**：Spec 文档（markdown 格式）。
+
+---
+
+### 阶段四：实施计划 (Plan)
+
+**目标**：拆成 step-by-step 可执行步骤。
+
+1. 拆分为 5-15 个具体步骤，每步有明确的输入和输出。
+2. 每步标注涉及的文件（含路径）。
+3. 对每步预估风险和建议验证方式。
+4. L2/L3 任务必须明确测试策略：哪些步骤需要单元测试/集成测试/E2E。
+
+**输出**：实施步骤清单。
+
+---
+
+### 阶段五：TDD 执行 (Execute)
+
+**目标**：先写测试，再写实现。严格 TDD。
+
+1. **RED（先写测试）**：编写测试，运行确认失败。
+2. **GREEN（最小实现）**：写最少代码让测试通过。
+3. **REFACTOR（重构）**：消除重复、改善结构，测试仍通过。
+4. 按阶段四的步骤顺序，每步重复 RED → GREEN → REFACTOR 循环。
+
+**关键纪律**：
+- 不要先写实现再补测试（那是补测，不是 TDD）
+- 每次只改一个关注点
+- 改动后立即运行测试
+- L3 任务每个关键边界条件都要有测试
+- 如果确实无法写测试（比如纯视觉改动），必须说明原因和替代验证方式
+
+---
+
+### 阶段六：代码审查 (Code Review)
+
+**目标**：以 reviewer 视角自查代码质量。
+
+1. **安全检查（优先级最高）**：
+   - 有无硬编码密钥/密码/Token
+   - 用户输入是否校验（边界值、注入、XSS）
+   - 身份验证/授权是否正确
+   - 是否泄漏内部错误信息给外部
+2. **逻辑检查**：
+   - 条件判断是否正确（边界值、空值、并发）
+   - 错误处理是否完善（不吞异常、不抛无意义错误）
+   - 是否有 race condition
+3. **结构检查**：
+   - 是否遵循项目已有的模式和约定
+   - 是否有重复代码可以提取
+   - 命名是否清晰
+
+**输出**：审查清单（每项标注通过/需要修改/无此问题）。
+
+---
+
+### 阶段七：质量验证 (Verify)
+
+**目标**：确保交付质量达标。
+
+1. 运行全量测试：`bun test`（或项目对应的测试命令）。
+2. 运行类型检查：`bun run typecheck`。
+3. 运行 lint：`bun run lint`（如有）。
+4. 检查测试覆盖率，确认核心逻辑覆盖率 ≥ 80%。
+5. 如果有跳过的测试或未覆盖的场景，必须在 L2/L3 任务中解释原因。
+
+**输出**：
+- 测试结果（通过数 / 失败数）
+- 覆盖率概览
+- 未覆盖项及原因（如有）
+
+---
+
+### 阶段八：交付总结 (Delivery)
+
+**目标**：产出可 review 的完整交付物。
+
+```
+## 交付总结
+
+### 需求
+<1 句话>
+
+### 风险等级
+L0 / L1 / L2 / L3
+
+### Spec
+<链接或摘要>
+
+### 改动文件
+- `path/to/file1.ts` — 改了什么
+- `path/to/file2.ts` — 改了什么
+
+### 测试覆盖
+- [x] 单元测试: X 个
+- [x] 集成测试: Y 个
+- [ ] 未覆盖项: ... (原因: ...)
+
+### 代码审查结论
+- 安全问题: 无 / 已修复说明
+- 性能风险: 无 / 已优化说明
+- 边界条件: 已覆盖 / 未覆盖说明
+
+### 回滚方式
+<如何回滚、是否影响数据>
+
+### AI 参与说明
+- 使用工作流: /mty-team
+- AI 参与内容: 需求拆解 / 代码生成 / 测试生成 / 审查
+- 人工需要重点 review 的部分: <文件/模块>
+```
+
+---
+
+## 多模型配置指引（可选）
+
+默认所有八个阶段由当前会话的同一模型完成。如果你希望在不同阶段使用不同模型，可以在项目根目录的 `mtycoder.json`（或 `mtycoder.jsonc`）中配置 `model_groups`：
+
+```jsonc
+{
+  "model_groups": {
+    "team-plan": {
+      "default": "anthropic/claude-sonnet-4-6",
+      "models": ["anthropic/claude-sonnet-4-6", "anthropic/claude-opus-4-8"]
+    },
+    "team-implement": {
+      "default": "anthropic/claude-sonnet-4-6",
+      "models": ["anthropic/claude-sonnet-4-6", "openai/gpt-5"]
+    },
+    "team-review": {
+      "default": "anthropic/claude-sonnet-4-6",
+      "models": ["anthropic/claude-sonnet-4-6"]
+    }
+  }
+}
+```
+
+- `team-plan`：用于需求澄清、风险分级、spec 编写和计划阶段（侧重推理深度）
+- `team-implement`：用于 TDD 执行和质量验证阶段（侧重代码生成速度）
+- `team-review`：用于代码审查和交付总结阶段（侧重严谨性）
+
+**没有多模型账号？完全没问题。** 当前模型全程跑通八个阶段。所有阶段产出质量来自 prompt 流程设计本身，多模型协作是锦上添花。
+
+---
+
+## 特殊说明
+
+1. **阶段可以跳过**：L0 任务自动跳过 Spec 和 TDD。L1 任务使用 mini spec。提示用户确认是否需要跳过某些阶段。
+2. **堵塞时暂停**：当测试一直失败、遇到不熟悉的技术、或者需要人为判断时，停下来向用户说明阻塞点，不强行推进。
+3. **不假设需求**：如果用户需求有歧义，宁可多在阶段一追问，不要在前面猜测后面推翻。

package/src/command/template/review.txt

@@ -0,0 +1,101 @@
+You are a code reviewer. Your job is to review code changes and provide actionable feedback.
+
+---
+
+Input: $ARGUMENTS
+
+---
+
+## Determining What to Review
+
+Based on the input provided, determine which type of review to perform:
+
+1. **No arguments (default)**: Review all uncommitted changes
+   - Run: `git diff` for unstaged changes
+   - Run: `git diff --cached` for staged changes
+   - Run: `git status --short` to identify untracked (net new) files
+
+2. **Commit hash** (40-char SHA or short hash): Review that specific commit
+   - Run: `git show $ARGUMENTS`
+
+3. **Branch name**: Compare current branch to the specified branch
+   - Run: `git diff $ARGUMENTS...HEAD`
+
+4. **PR URL or number** (contains "github.com" or "pull" or looks like a PR number): Review the pull request
+   - Run: `gh pr view $ARGUMENTS` to get PR context
+   - Run: `gh pr diff $ARGUMENTS` to get the diff
+
+Use best judgement when processing input.
+
+---
+
+## Gathering Context
+
+**Diffs alone are not enough.** After getting the diff, read the entire file(s) being modified to understand the full context. Code that looks wrong in isolation may be correct given surrounding logic—and vice versa.
+
+- Use the diff to identify which files changed
+- Use `git status --short` to identify untracked files, then read their full contents
+- Read the full file to understand existing patterns, control flow, and error handling
+- Check for existing style guide or conventions files (CONVENTIONS.md, AGENTS.md, .editorconfig, etc.)
+
+---
+
+## What to Look For
+
+**Bugs** - Your primary focus.
+- Logic errors, off-by-one mistakes, incorrect conditionals
+- If-else guards: missing guards, incorrect branching, unreachable code paths
+- Edge cases: null/empty/undefined inputs, error conditions, race conditions
+- Security issues: injection, auth bypass, data exposure
+- Broken error handling that swallows failures, throws unexpectedly or returns error types that are not caught.
+
+**Structure** - Does the code fit the codebase?
+- Does it follow existing patterns and conventions?
+- Are there established abstractions it should use but doesn't?
+- Excessive nesting that could be flattened with early returns or extraction
+
+**Performance** - Only flag if obviously problematic.
+- O(n²) on unbounded data, N+1 queries, blocking I/O on hot paths
+
+**Behavior Changes** - If a behavioral change is introduced, raise it (especially if it's possibly unintentional).
+
+---
+
+## Before You Flag Something
+
+**Be certain.** If you're going to call something a bug, you need to be confident it actually is one.
+
+- Only review the changes - do not review pre-existing code that wasn't modified
+- Don't flag something as a bug if you're unsure - investigate first
+- Don't invent hypothetical problems - if an edge case matters, explain the realistic scenario where it breaks
+- If you need more context to be sure, use the tools below to get it
+
+**Don't be a zealot about style.** When checking code against conventions:
+
+- Verify the code is *actually* in violation. Don't complain about else statements if early returns are already being used correctly.
+- Some "violations" are acceptable when they're the simplest option. A `let` statement is fine if the alternative is convoluted.
+- Excessive nesting is a legitimate concern regardless of other style choices.
+- Don't flag style preferences as issues unless they clearly violate established project conventions.
+
+---
+
+## Tools
+
+Use these to inform your review:
+
+- **Explore agent** - Find how existing code handles similar problems. Check patterns, conventions, and prior art before claiming something doesn't fit.
+- **Exa Code Context** - Verify correct usage of libraries/APIs before flagging something as wrong.
+- **Exa Web Search** - Research best practices if you're unsure about a pattern.
+
+If you're uncertain about something and can't verify it with these tools, say "I'm not sure about X" rather than flagging it as a definite issue.
+
+---
+
+## Output
+
+1. If there is a bug, be direct and clear about why it is a bug.
+2. Clearly communicate severity of issues. Do not overstate severity.
+3. Critiques should clearly and explicitly communicate the scenarios, environments, or inputs that are necessary for the bug to arise. The comment should immediately indicate that the issue's severity depends on these factors.
+4. Your tone should be matter-of-fact and not accusatory or overly positive. It should read as a helpful AI assistant suggestion without sounding too much like a human reviewer.
+5. Write so the reader can quickly understand the issue without reading too closely.
+6. AVOID flattery, do not give any comments that are not helpful to the reader. Avoid phrasing like "Great job ...", "Thanks for ...".

package/src/config/agent.ts

@@ -0,0 +1,197 @@
+export * as ConfigAgent from "./agent"
+
+import { Schema } from "effect"
+import z from "zod"
+import { Bus } from "@/bus"
+import { zod, ZodOverride } from "@/util/effect-zod"
+import { Log } from "../util"
+import { NamedError } from "@mty-coder/shared/util/error"
+import { Glob } from "@mty-coder/shared/util/glob"
+import { configEntryNameFromPath } from "./entry-name"
+import { InvalidError } from "./error"
+import * as ConfigMarkdown from "./markdown"
+import { ConfigModelID } from "./model-id"
+import { ConfigPermission } from "./permission"
+
+const log = Log.create({ service: "config" })
+
+const PositiveInt = Schema.Number.check(Schema.isInt()).check(Schema.isGreaterThan(0))
+
+const Color = Schema.Union([
+  Schema.String.check(Schema.isPattern(/^#[0-9a-fA-F]{6}$/)),
+  Schema.Literals(["primary", "secondary", "accent", "success", "warning", "error", "info"]),
+])
+
+// ConfigPermission.Info is a zod schema (its `.preprocess(...).transform(...)`
+// shape lives outside the Effect Schema type system), so the walker reaches it
+// via ZodOverride rather than a pure Schema reference.  This preserves the
+// `$ref: PermissionConfig` emitted in openapi.json.
+const PermissionRef = Schema.Any.annotate({ [ZodOverride]: ConfigPermission.Info })
+
+const AgentSchema = Schema.StructWithRest(
+  Schema.Struct({
+    model: Schema.optional(ConfigModelID).annotate({
+      description:
+        "Model for this agent: a literal provider/model (e.g. anthropic/claude-opus-4-8) or a tier/group name (e.g. ultra/standard/lite). Names without a '/' are resolved as model groups, provider-aware, at spawn time.",
+    }),
+    variant: Schema.optional(Schema.String).annotate({
+      description: "Default model variant for this agent (applies only when using the agent's configured model).",
+    }),
+    temperature: Schema.optional(Schema.Number),
+    top_p: Schema.optional(Schema.Number),
+    prompt: Schema.optional(Schema.String),
+    tools: Schema.optional(Schema.Record(Schema.String, Schema.Boolean)).annotate({
+      description: "@deprecated Use 'permission' field instead",
+    }),
+    disable: Schema.optional(Schema.Boolean),
+    description: Schema.optional(Schema.String).annotate({ description: "Description of when to use the agent" }),
+    mode: Schema.optional(Schema.Literals(["subagent", "primary", "all"])),
+    hidden: Schema.optional(Schema.Boolean).annotate({
+      description: "Hide this subagent from the @ autocomplete menu (default: false, only applies to mode: subagent)",
+    }),
+    options: Schema.optional(Schema.Record(Schema.String, Schema.Any)),
+    color: Schema.optional(Color).annotate({
+      description: "Hex color code (e.g., #FF5733) or theme color (e.g., primary)",
+    }),
+    steps: Schema.optional(PositiveInt).annotate({
+      description: "Maximum number of agentic iterations before forcing text-only response",
+    }),
+    tool_allowlist: Schema.optional(Schema.Array(Schema.String)).annotate({
+      description: "Optional list of tool IDs allowed for this agent. When set, only these tools are available.",
+    }),
+    maxSteps: Schema.optional(PositiveInt).annotate({ description: "@deprecated Use 'steps' field instead." }),
+    permission: Schema.optional(PermissionRef),
+  }),
+  [Schema.Record(Schema.String, Schema.Any)],
+)
+
+const KNOWN_KEYS = new Set([
+  "name",
+  "model",
+  "variant",
+  "prompt",
+  "description",
+  "temperature",
+  "top_p",
+  "mode",
+  "hidden",
+  "color",
+  "steps",
+  "maxSteps",
+  "options",
+  "permission",
+  "disable",
+  "tools",
+  "tool_allowlist",
+])
+
+// Post-parse normalisation:
+//  - Promote any unknown-but-present keys into `options` so they survive the
+//    round-trip in a well-known field.
+//  - Translate the deprecated `tools: { name: boolean }` map into the new
+//    `permission` shape (write-adjacent tools collapse into `permission.edit`).
+//  - Coalesce `steps ?? maxSteps` so downstream can ignore the deprecated alias.
+const normalize = (agent: z.infer<typeof Info>) => {
+  const options: Record<string, unknown> = { ...agent.options }
+  for (const [key, value] of Object.entries(agent)) {
+    if (!KNOWN_KEYS.has(key)) options[key] = value
+  }
+
+  const permission: ConfigPermission.Info = {}
+  for (const [tool, enabled] of Object.entries(agent.tools ?? {})) {
+    const action = enabled ? "allow" : "deny"
+    if (tool === "write" || tool === "edit" || tool === "patch" || tool === "multiedit") {
+      permission.edit = action
+      continue
+    }
+    if (tool === "task") {
+      permission.actor = action
+      continue
+    }
+    permission[tool] = action
+  }
+  globalThis.Object.assign(permission, agent.permission)
+
+  return { ...agent, options, permission, steps: agent.steps ?? agent.maxSteps }
+}
+
+export const Info = zod(AgentSchema).transform(normalize).meta({ ref: "AgentConfig" }) as unknown as z.ZodType<
+  Omit<z.infer<ReturnType<typeof zod<typeof AgentSchema>>>, "options" | "permission" | "steps"> & {
+    options?: Record<string, unknown>
+    permission?: ConfigPermission.Info
+    steps?: number
+  }
+>
+export type Info = z.infer<typeof Info>
+
+export async function load(dir: string) {
+  const result: Record<string, Info> = {}
+  for (const item of await Glob.scan("{agent,agents}/**/*.md", {
+    cwd: dir,
+    absolute: true,
+    dot: true,
+    symlink: true,
+  })) {
+    const md = await ConfigMarkdown.parse(item).catch(async (err) => {
+      const message = ConfigMarkdown.FrontmatterError.isInstance(err)
+        ? err.data.message
+        : `Failed to parse agent ${item}`
+      const { Session } = await import("@/session")
+      void Bus.publish(Session.Event.Error, { error: new NamedError.Unknown({ message }).toObject() })
+      log.error("failed to load agent", { agent: item, err })
+      return undefined
+    })
+    if (!md) continue
+
+    const patterns = ["/.mtycoder/agent/", "/.mtycoder/agents/", "/agent/", "/agents/"]
+    const name = configEntryNameFromPath(item, patterns)
+
+    const config = {
+      name,
+      ...md.data,
+      prompt: md.content.trim(),
+    }
+    const parsed = Info.safeParse(config)
+    if (parsed.success) {
+      result[config.name] = parsed.data
+      continue
+    }
+    throw new InvalidError({ path: item, issues: parsed.error.issues }, { cause: parsed.error })
+  }
+  return result
+}
+
+export async function loadMode(dir: string) {
+  const result: Record<string, Info> = {}
+  for (const item of await Glob.scan("{mode,modes}/*.md", {
+    cwd: dir,
+    absolute: true,
+    dot: true,
+    symlink: true,
+  })) {
+    const md = await ConfigMarkdown.parse(item).catch(async (err) => {
+      const message = ConfigMarkdown.FrontmatterError.isInstance(err)
+        ? err.data.message
+        : `Failed to parse mode ${item}`
+      const { Session } = await import("@/session")
+      void Bus.publish(Session.Event.Error, { error: new NamedError.Unknown({ message }).toObject() })
+      log.error("failed to load mode", { mode: item, err })
+      return undefined
+    })
+    if (!md) continue
+
+    const config = {
+      name: configEntryNameFromPath(item, []),
+      ...md.data,
+      prompt: md.content.trim(),
+    }
+    const parsed = Info.safeParse(config)
+    if (parsed.success) {
+      result[config.name] = {
+        ...parsed.data,
+        mode: "primary" as const,
+      }
+    }
+  }
+  return result
+}

package/src/config/command.ts

@@ -0,0 +1,69 @@
+export * as ConfigCommand from "./command"
+
+import { Log } from "../util"
+import { Schema } from "effect"
+import { NamedError } from "@mty-coder/shared/util/error"
+import { Glob } from "@mty-coder/shared/util/glob"
+import { Bus } from "@/bus"
+import { zod } from "@/util/effect-zod"
+import { withStatics } from "@/util/schema"
+import { configEntryNameFromPath } from "./entry-name"
+import { InvalidError } from "./error"
+import * as ConfigMarkdown from "./markdown"
+import { ConfigModelID } from "./model-id"
+
+const log = Log.create({ service: "config" })
+
+export const Info = Schema.Struct({
+  template: Schema.String,
+  description: Schema.optional(Schema.String),
+  agent: Schema.optional(Schema.String),
+  model: Schema.optional(ConfigModelID),
+  subtask: Schema.optional(Schema.Boolean),
+}).pipe(withStatics((s) => ({ zod: zod(s) })))
+
+export type Info = Schema.Schema.Type<typeof Info>
+
+export async function load(dir: string) {
+  const result: Record<string, Info> = {}
+  for (const item of await Glob.scan("{command,commands}/**/*.md", {
+    cwd: dir,
+    absolute: true,
+    dot: true,
+    symlink: true,
+  })) {
+    const md = await ConfigMarkdown.parse(item).catch(async (err) => {
+      const message = ConfigMarkdown.FrontmatterError.isInstance(err)
+        ? err.data.message
+        : `Failed to parse command ${item}`
+      const { Session } = await import("@/session")
+      void Bus.publish(Session.Event.Error, { error: new NamedError.Unknown({ message }).toObject() })
+      log.error("failed to load command", { command: item, err })
+      return undefined
+    })
+    if (!md) continue
+
+    const patterns = [
+      "/.mtycoder/command/",
+      "/.mtycoder/commands/",
+      "/.claude/command/",
+      "/.claude/commands/",
+      "/command/",
+      "/commands/",
+    ]
+    const name = configEntryNameFromPath(item, patterns)
+
+    const config = {
+      name,
+      ...md.data,
+      template: md.content.trim(),
+    }
+    const parsed = Info.zod.safeParse(config)
+    if (parsed.success) {
+      result[config.name] = parsed.data
+      continue
+    }
+    throw new InvalidError({ path: item, issues: parsed.error.issues }, { cause: parsed.error })
+  }
+  return result
+}