@surething/cockpit 1.0.214 → 1.0.216

package/.next-prod/trace-build

@@ -1 +1 @@
-[{"name":"run-webpack","duration":19087291,"timestamp":142464968,"id":14,"parentId":1,"tags":{},"startTime":1779766291178,"traceId":"d3556d598e003c4d"},{"name":"run-typescript","duration":16575237,"timestamp":161555976,"id":1519,"parentId":1,"tags":{},"startTime":1779766310269,"traceId":"d3556d598e003c4d"},{"name":"static-check","duration":1137951,"timestamp":178174698,"id":1522,"parentId":1,"tags":{},"startTime":1779766326888,"traceId":"d3556d598e003c4d"},{"name":"static-generation","duration":6046617,"timestamp":179543527,"id":1778,"parentId":1,"tags":{},"startTime":1779766328257,"traceId":"d3556d598e003c4d"},{"name":"collect-build-traces","duration":19568222,"timestamp":179313463,"id":1775,"parentId":1,"tags":{},"startTime":1779766328026,"traceId":"d3556d598e003c4d"},{"name":"telemetry-flush","duration":55,"timestamp":198885457,"id":1787,"parentId":1,"tags":{},"startTime":1779766347598,"traceId":"d3556d598e003c4d"},{"name":"next-build","duration":56597602,"timestamp":142287921,"id":1,"tags":{"buildMode":"default","version":"16.2.6","bundler":"webpack","has-custom-webpack-config":"true","use-build-worker":"false"},"startTime":1779766291001,"traceId":"d3556d598e003c4d"}]
+[{"name":"run-webpack","duration":20691327,"timestamp":204749108,"id":14,"parentId":1,"tags":{},"startTime":1779801780173,"traceId":"2868cd35fd02ca16"},{"name":"run-typescript","duration":16713005,"timestamp":225450994,"id":1519,"parentId":1,"tags":{},"startTime":1779801800875,"traceId":"2868cd35fd02ca16"},{"name":"static-check","duration":1098623,"timestamp":242207653,"id":1522,"parentId":1,"tags":{},"startTime":1779801817632,"traceId":"2868cd35fd02ca16"},{"name":"static-generation","duration":6111104,"timestamp":243692459,"id":1778,"parentId":1,"tags":{},"startTime":1779801819116,"traceId":"2868cd35fd02ca16"},{"name":"collect-build-traces","duration":18808913,"timestamp":243307085,"id":1775,"parentId":1,"tags":{},"startTime":1779801818731,"traceId":"2868cd35fd02ca16"},{"name":"telemetry-flush","duration":54,"timestamp":262119910,"id":1787,"parentId":1,"tags":{},"startTime":1779801837544,"traceId":"2868cd35fd02ca16"},{"name":"next-build","duration":57539004,"timestamp":204580974,"id":1,"tags":{"buildMode":"default","version":"16.2.6","bundler":"webpack","has-custom-webpack-config":"true","use-build-worker":"false"},"startTime":1779801780005,"traceId":"2868cd35fd02ca16"}]

package/README.md

@@ -49,7 +49,7 @@ Cockpit is the instrument panel. It does **not** replace Claude Code; it stands
 | Agent can't reach your browser / DB | **Smart Bubbles**: Chrome, PostgreSQL, MySQL, Redis — drivable by the agent |
 | Reading an unfamiliar repo means a 90-min file-tree scavenger hunt | **Code Map** chip view — caller / callee pins, click to walk the call graph |
 | Reviewing AI output is friction | **LAN-shared review pages**, line-level comments, send any comment back as AI context |
-| Same "do X but don't change code" prompt every day | **Slash modes** `/qa /fx /review /commit` + custom `~/.claude/commands/*.md` |
+| Same "do X but don't change code" prompt every day | **Slash modes** `/qa /fx /ex /go /cg /cc` + custom `SKILL.md` via the Skills sidebar |
 | No automation hooks | One-time / interval / cron-based **scheduled tasks** |
 | "Cloud relay" trust concerns | **Fully local**. No telemetry. Keys (Codex / DeepSeek / Kimi) stay in `~/.cockpit/settings.json` on your laptop. |
 
@@ -80,7 +80,7 @@ Cockpit is the instrument panel. It does **not** replace Claude Code; it stands
 - Git **blame**, diff view, branch switching, **worktree** management
 - **LSP integration** — go to definition, find references, hover info
 - **Code Map** — every function as a chip with caller / callee pins; click to walk the call graph. Multi-language: TS/JS, Python, Go, Rust. No LSP, no project setup, works offline.
-- **CodeGraph** — a **code graph** for the agent: same tree-sitter index exposed as 6 HTTP endpoints (`search` / `callers` / `callees` / `impact` / `file` / `coedit`) so the agent queries coordinates instead of grepping text; trigger with `/cg` from chat. Coordinates only, never source — precise, cheap, and catches the conventional coupling no regex can.
+- **CodeGraph** — a **code graph** for the agent: same tree-sitter index exposed as 10 HTTP endpoints — 6 base (`search` / `callers` / `callees` / `impact` / `file` / `coedit`) + 4 analytics (`context` / `related` / `risk` / `affected`, powered by PageRank · PPR · TF-IDF · Louvain, zero training) — so the agent queries coordinates instead of grepping text; trigger with `/cg` from chat. Coordinates only, never source — precise, cheap, and catches the conventional coupling no regex can.
 - Fuzzy file search (Cmd+F), JSON viewer, Markdown preview
 
 ### Console — Terminal & smart Bubbles
@@ -103,10 +103,11 @@ Cockpit is the instrument panel. It does **not** replace Claude Code; it stands
 
 - `/qa` — **Clarify-only**: restate, ask back, never code
 - `/fx` — **Diagnose-only**: bug evidence chain, never edit
-- `/review` — read the diff, write notes, no rewrites
-- `/commit` — stage + draft a message in your repo's style + commit
-- `/cg` — **CodeGraph** project exploration: 6 HTTP endpoints for symbol / callers / impact / co-edit queries (precise where grep is fuzzy)
-- **Custom**: drop any `*.md` into `~/.claude/commands/` or `./.claude/commands/` → instant slash command
+- `/ex` — **Explore**: 6-step structured discussion skeleton (study → diverge → converge → re-diverge → iterate-verify → summarize)
+- `/go` — **Land**: take a converged plan, slice into MVP stages, write + self-verify per stage, recap at end
+- `/cg` — **CodeGraph** project exploration: 10 HTTP endpoints for symbol / callers / impact / co-edit / risk / affected queries (precise where grep is fuzzy)
+- `/cc` — **Cockpit CLI**: drive the cockpit CLI surface — codegraph subcommands, terminal observation, browser automation
+- **Custom**: drop any `SKILL.md` and add it via the Skills sidebar — it auto-appears in the slash autocomplete menu (see [Skills](#skills--extensibility))
 
 ### Scheduled tasks — Cron for AI
 
@@ -125,7 +126,7 @@ Cockpit is the instrument panel. It does **not** replace Claude Code; it stands
 - **Day one in an unfamiliar repo:** Open it in Code Map, click through caller/callee pins, walk the auth flow in five clicks instead of a 90-minute file-tree scavenger hunt.
 - **Two-person team:** Senior reviews via LAN-shared review page, no GitHub PR round-trip needed for in-progress work.
 - **Reviewing AI-generated PRs:** Switch the changed files into Code Map — changed functions are highlighted with their callers / callees still drawn around them, so blast-radius is one click away.
-- **Full-stack chore mode:** `/fx` in one tab on a backend bug, `/review` in another on the frontend diff, `/commit` to wrap up — three slash modes, three different agent postures.
+- **Full-stack chore mode:** `/fx` in one tab on a backend bug, `/ex` in another to plan the frontend refactor, `/go` to land it — three slash modes, three different agent postures.
 - **Cheap second opinion:** Same prompt in two tabs — Claude in one, **DeepSeek v4-pro** in the other — compare answers before you trust either.
 - **AI-driven QA:** Browser Bubble + scheduled task = "every night at 2 AM, run this UI smoke flow and post a summary".
 - **Privacy-sensitive code:** runs on your laptop. Pair with an **Ollama** tab for fully air-gapped sessions. No telemetry, no relay.

package/README.zh.md

@@ -49,7 +49,7 @@ Cockpit 就是那个仪表盘。它**不替代** Claude Code，而是站在官
 | Agent 够不到浏览器 / 数据库 | **智能气泡**：Chrome、PostgreSQL、MySQL、Redis —— Agent 可驱动 |
 | 读陌生仓库就是 90 分钟"找地鼠" | **代码地图（Code Map）** chip 视图 —— caller / callee pin 一点即跳 |
 | AI 输出审阅低效 | **局域网共享评审页**、行级评论、任意评论可回喂给 AI |
-| 每天写一遍"做 X 但不要动代码" | **斜杠模式** `/qa /fx /review /commit` + 自定义 `~/.claude/commands/*.md` |
+| 每天写一遍"做 X 但不要动代码" | **斜杠模式** `/qa /fx /ex /go /cg /cc` + 通过 Skills 侧边栏自定义 `SKILL.md` |
 | 没有自动化触发器 | 一次性 / 间隔 / **Cron** **定时任务** |
 | 担心"云端中转" | **完全本地**。无遥测，Codex / DeepSeek / Kimi 的 Key 仅存在本机 `~/.cockpit/settings.json` |
 
@@ -80,7 +80,7 @@ Cockpit 就是那个仪表盘。它**不替代** Claude Code，而是站在官
 - Git **blame**、Diff 视图、分支切换、**Worktree** 管理
 - **LSP 集成** —— 跳转定义、查找引用、悬浮类型信息
 - **代码地图（Code Map）** —— 每个函数渲染为 chip，左右两侧分别列出 caller / callee，点击 pin 即可顺着调用图走。多语言支持：TS/JS、Python、Go、Rust。无需 LSP、无需项目预热，离线可用。
-- **CodeGraph（项目图谱）** —— 给 Agent 的**代码图谱（code graph）**：同一份 tree-sitter 索引开放为 6 个 HTTP 接口（`search` / `callers` / `callees` / `impact` / `file` / `coedit`），Agent 直接按坐标精确查询，无须 grep 字面。在 chat 输入 `/cg` 触发。只返坐标不返源码——比 grep 精确、比 Read 省 token，还能抓住 regex 看不见的「约定耦合」。
+- **CodeGraph（项目图谱）** —— 给 Agent 的**代码图谱（code graph）**：同一份 tree-sitter 索引开放为 10 个 HTTP 接口 —— 基础 6 个（`search` / `callers` / `callees` / `impact` / `file` / `coedit`）+ 分析 4 个（`context` / `related` / `risk` / `affected`，由 PageRank · PPR · TF-IDF · Louvain 驱动，零训练），Agent 直接按坐标精确查询，无须 grep 字面。在 chat 输入 `/cg` 触发。只返坐标不返源码——比 grep 精确、比 Read 省 token，还能抓住 regex 看不见的「约定耦合」。
 - 模糊搜索 (Cmd+F)、JSON 查看器、Markdown 预览
 
 ### Console —— 终端与智能气泡
@@ -103,10 +103,11 @@ Cockpit 就是那个仪表盘。它**不替代** Claude Code，而是站在官
 
 - `/qa` —— **只澄清**：复述、反问、绝不写代码
 - `/fx` —— **只诊断**：Bug 证据链分析，绝不改文件
-- `/review` —— 读 diff、写评审，不动手重写
-- `/commit` —— 暂存改动、按你仓库的风格起草 message、提交
-- `/cg` —— **CodeGraph 项目探索**：6 个 HTTP 接口按符号 / 调用关系 / 影响范围 / 协同编辑精确查询（比 grep 精准）
-- **自定义**：`~/.claude/commands/` 或 `./.claude/commands/` 下任意 `*.md` 即斜杠指令
+- `/ex` —— **探讨**：6 步结构化讨论骨架（研究 → 发散 → 收敛 → 再发散 → 迭代验证 → 总结）
+- `/go` —— **落地**：把收敛后的方案切成 MVP 阶段，每阶段自运行验证，最后端到端回看
+- `/cg` —— **CodeGraph 项目探索**：10 个 HTTP 接口按符号 / 调用关系 / 影响范围 / 协同编辑 / 风险 / 受影响测试精确查询（比 grep 精准）
+- `/cc` —— **Cockpit CLI**：驾驭 cockpit 命令行 —— codegraph 子命令、terminal 观察、browser 自动化
+- **自定义**：任意 `SKILL.md` 通过 Skills 侧边栏添加 —— 自动出现在斜杠补全菜单（见 [Skills](#skills--可扩展性)）
 
 ### 定时任务 —— 给 AI 的 Cron
 
@@ -125,7 +126,7 @@ Cockpit 就是那个仪表盘。它**不替代** Claude Code，而是站在官
 - **新仓库的第一天：** 用 Code Map 打开它，沿着 caller / callee pin 一路点过去 —— 鉴权流程 5 次点击就走完，不再是 90 分钟的"文件树找地鼠"。
 - **二人小团队：** Senior 用局域网共享评审页 review，半成品代码不用绕 GitHub PR。
 - **评审 AI 写的 PR：** 把改动文件切到 Code Map，**改动过的函数被高亮**，周围还画着它们的 caller / callee —— 一眼看清这次改动的爆炸半径。
-- **全栈杂活模式：** 后端 bug 一个 tab 跑 `/fx`，前端 diff 另一个 tab 跑 `/review`，最后 `/commit` 收尾 —— 三种姿态、三种 Agent 模式。
+- **全栈杂活模式：** 后端 bug 一个 tab 跑 `/fx`，另一个 tab 跑 `/ex` 规划前端重构，最后 `/go` 落地 —— 三种姿态、三种 Agent 模式。
 - **便宜的二次意见：** 同一个 prompt 在两个 tab 跑 —— 一个 Claude、一个 **DeepSeek v4-pro**，对比答案后再决定相信谁。
 - **AI 自动化 QA：** 浏览器气泡 + 定时任务 = "每晚 2 点跑一遍 UI 冒烟流程并发摘要"。
 - **隐私敏感代码：** 在你的笔记本上跑。配合 **Ollama** tab 即可完全断网工作。无遥测、无中转。

package/bin/cock-browser.mjs

@@ -40,6 +40,32 @@ Usage: cockpit browser ${prefix} <action>`);
   }
 
   console.log(`
+── React / SPA gotchas ────────────────────────────────
+On modern SPAs (React, Vue, tiptap, ProseMirror, Lexical, Slate, …)
+\`type\` / \`click\` via CDP often silently no-op because the framework
+ignores raw key/mouse events and reacts only to its own synthetic
+event flow. When typing into a contenteditable / controlled input,
+or clicking a button rendered by a portal, **prefer \`evaluate\`**.
+
+Three templates that always work:
+
+  # 1) Fill a contenteditable (tiptap / ProseMirror / Lexical):
+  evaluate "(() => { const el = document.querySelector('[contenteditable=\\"true\\"]'); el.focus(); document.execCommand('insertText', false, 'hello'); return el.innerText; })()"
+
+  # 2) Set a React-controlled <input> via the native setter + input event:
+  evaluate "(() => { const el = document.querySelector('input[name=foo]'); const set = Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype, 'value').set; set.call(el, 'hello'); el.dispatchEvent(new Event('input', { bubbles: true })); return el.value; })()"
+
+  # 3) Click a button by aria-label / text (refs go stale after re-render):
+  evaluate "(() => { const btn = Array.from(document.querySelectorAll('button')).find(b => b.getAttribute('aria-label') === 'Send message' || b.textContent.trim() === 'Send'); if (!btn) return 'not-found'; btn.click(); return 'clicked'; })()"
+
+Refs (e5, e23, …) returned by \`snapshot\` are valid only for the
+DOM at snapshot time. Any re-render / route change / focus shift
+invalidates them — \`Element ref "eN" not found or disconnected\`
+means you need a fresh \`snapshot\` (or just use \`evaluate\` with
+CSS selectors).
+
+──────────────────────────────────────────────────────
+
 Navigation:
   navigate <url>              Navigate to URL
   reload [--noCache]          Reload page
@@ -52,9 +78,9 @@ Inspection:
   screenshot                  Take a screenshot
 
 Interaction (use ref from snapshot):
-  click <ref>                 Click element
-  type <ref> <text>           Type text into element
-  fill <ref> <value>          Fill input value
+  click <ref>                 Click element  ⚠ React/SPA: may silently miss; use evaluate
+  type <ref> <text>           Type text  ⚠ React/SPA: may silently miss; use evaluate (template 1/2)
+  fill <ref> <value>          Fill input value  ⚠ Same — prefer template 2
   hover <ref>                 Hover element
   focus <ref>                 Focus element
   scroll --direction D        Scroll page (up/down/left/right)
@@ -337,6 +363,70 @@ async function run() {
     // 这里透明地把完整内容拉回来，调用方看不到 chunking 细节。
     const resolved = await autoResolveChunked(baseUrl, id, data.data, timeout);
 
+    // Post-`type` verification — `type` via CDP dispatchKeyEvent silently no-ops
+    // on React-controlled / contenteditable inputs (tiptap, ProseMirror, Lexical,
+    // Slate, etc.) because those frameworks update state from synthetic
+    // InputEvents rather than physical key events. The CLI used to return
+    // `{typed, ref}` regardless, lying about the result. Now we read back the
+    // currently-focused element's value/textContent and compare; mismatches
+    // exit 1 with a pointer to the evaluate workaround. Session 0a975cff
+    // burned 4 extra bash calls discovering this silently.
+    //
+    // We use document.activeElement because `type` focuses the target as its
+    // first step — so right after a successful type, activeElement IS the
+    // target. The Playwright "ref" (e555 etc.) has no DOM-side equivalent, so
+    // we can't query for it directly.
+    if (action === 'type' && params.ref && typeof params.text === 'string') {
+      const expected = String(params.text);
+      let actual = '';
+      let kind = 'unknown';
+      try {
+        const verifyJs =
+          '(() => { const el = document.activeElement; ' +
+          'if (!el || el === document.body) return { kind: "no-active", text: "" }; ' +
+          'const tag = el.tagName ? el.tagName.toLowerCase() : ""; ' +
+          'if (tag === "input" || tag === "textarea") return { kind: tag, text: el.value || "" }; ' +
+          'if (el.isContentEditable) return { kind: "contenteditable", text: el.innerText || el.textContent || "" }; ' +
+          'return { kind: tag || "unknown", text: (el.textContent || "").slice(0, 500) }; })()';
+        const v = await fetch(`${baseUrl}/api/browser/evaluate`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ id, params: { js: verifyJs }, timeout: 3000 }),
+          signal: AbortSignal.timeout(5000),
+        });
+        const vj = await v.json();
+        const out = vj.ok && vj.data;
+        if (out && typeof out === 'object') {
+          kind = out.kind;
+          actual = String(out.text || '');
+        }
+      } catch {
+        // verification optional — fall through to printing the original result
+      }
+
+      // Only warn on KNOWN editable types whose value/text doesn't contain what
+      // we typed. "no-active" / "unknown" we can't reliably verify, so we skip
+      // (no false positives).
+      const verifiable = kind === 'input' || kind === 'textarea' || kind === 'contenteditable';
+      if (verifiable && !actual.includes(expected)) {
+        // Type "succeeded" per CDP but the target didn't pick up the text.
+        // Almost always a React-controlled / contenteditable input.
+        process.stderr.write(
+          `\n⚠️  type succeeded per CDP but the target's value/textContent does NOT contain "${expected}".\n` +
+          `   target kind: ${kind}, current text: ${JSON.stringify(actual).slice(0, 200)}\n` +
+          `   This is usually a React-controlled or contenteditable input (tiptap / ProseMirror / Lexical / Slate)\n` +
+          `   where CDP key events don't trigger framework state updates.\n` +
+          `\n` +
+          `   Fix: use \`evaluate\` to drive the framework's own event flow, e.g.\n` +
+          `     cockpit browser ${id} evaluate "(() => { const el = document.querySelector('[contenteditable=\\\"true\\\"]'); el.focus(); document.execCommand('insertText', false, ${JSON.stringify(expected)}); return el.innerText; })()"\n` +
+          `\n   For a plain <input>, set value via property setter + dispatch an 'input' event:\n` +
+          `     evaluate "(() => { const el = document.querySelector('input[name=foo]'); const set = Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype, 'value').set; set.call(el, ${JSON.stringify(expected)}); el.dispatchEvent(new Event('input', { bubbles: true })); return el.value; })()"\n`
+        );
+        await formatOutput(action, resolved);
+        process.exit(1);
+      }
+    }
+
     // Format output
     await formatOutput(action, resolved);
   } catch (err) {