@te-river/opencode-team-mode 1.5.0 → 1.5.2

package/README.md

@@ -55,73 +55,40 @@ Instead of one agent trying to do everything, you get:
 
 ### Install TeamMode
 
-**Option A — One-line installer (recommended):**
+**Option A — One-line installer:**
 
 macOS / Linux (bash):
 ```bash
-curl -fsSL "https://gh-proxy.com/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.sh" | bash
+curl -fsSL https://ghproxy.net/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.sh | bash
 ```
 
 Windows (PowerShell):
 ```powershell
-irm "https://gh-proxy.com/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.ps1" | iex
+irm https://ghproxy.net/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.ps1 | iex
 ```
 
-If gh-proxy is unavailable, try jsdelivr or GitHub raw:
-```bash
-# macOS / Linux — jsdelivr
-curl -fsSL "https://cdn.jsdelivr.net/gh/Te-River/Opencode-TeamMode@main/scripts/install.sh" | bash
-
-# Windows — jsdelivr
-irm "https://cdn.jsdelivr.net/gh/Te-River/Opencode-TeamMode@main/scripts/install.ps1" | iex
-
-# macOS / Linux — GitHub raw
-curl -fsSL https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.sh | bash
-
-# Windows — GitHub raw
-irm https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.ps1 | iex
-```
-
-These scripts install the npm package and automatically register the plugin in your `opencode.jsonc`.
+**Option B — Manual config:**
 
-**Option B — Manual npm install:**
-
-```bash
-# 1. Install the plugin package
-npm install -g @te-river/opencode-team-mode
-
-# 2. Add the plugin to your opencode.jsonc
-#    (see "Configuration" below)
-```
-
-**Option C — Local dev install (from this repo):**
-
-```bash
-git clone https://github.com/Te-River/Opencode-TeamMode.git
-cd Opencode-TeamMode
-npm install
-npm run build
-npm link
-```
-
----
-
-## ⚙️ Configuration
-
-After installing, add the plugin to your `opencode.jsonc`:
+Add the plugin to your `opencode.jsonc`:
 
 ```jsonc
 {
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
-    "@te-river/opencode-team-mode@1.4.9"
+    "@te-river/opencode-team-mode@latest"
   ]
 }
 ```
 
-That's it. The plugin automatically injects all team agents and commands when OpenCode starts. **No need to manually copy agent files or command definitions.**
+OpenCode will automatically install the plugin on startup.
+
+> **Tip:** After modifying `opencode.json`, **restart OpenCode Desktop** for changes to take effect.
 
-> 💡 **Tip:** After modifying `opencode.json`, **restart OpenCode Desktop** for changes to take effect.
+---
+
+## ⚙️ Configuration
+
+The plugin automatically injects all team agents and commands when OpenCode starts. **No need to manually copy agent files or command definitions.**
 
 > ⚠️ **Model choice matters.** Every judgment in the workflow — triage,
 > decomposition, dispatch briefs, synthesis, review-loop verdicts — flows
@@ -139,7 +106,7 @@ To enable TeamMode in every project, add the plugin to your global config:
 {
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
-    "@te-river/opencode-team-mode@1.4.9"
+    "@te-river/opencode-team-mode@latest"
   ]
 }
 ```
@@ -251,6 +218,139 @@ In **OpenCode Desktop**, you get additional UX benefits:
 
 ---
 
+## 🧯 Context governance (tm_* + R6 + R2) — new in v1.5.1
+
+> ⚠️ Requires `@te-river/opencode-team-mode@1.5.1` or later (released
+> 2026-09-08). If your config pins `@latest`, OpenCode upgrades on next start.
+
+**JIT layer-2 tools (`tm_read` / `tm_grep` / `tm_bash` / `tm_fetch`).**
+Large tool outputs are context cost's main driver: every step re-sends the
+whole window. The tm_* tools run the built-in capability under governance
+first: results above `TM_OFFLOAD_THRESHOLD` tokens never enter the window —
+they are written to a local run store and replaced by a handle with a
+content-aware preview (JSON keys / CSV header+shape / log ERROR×N stats /
+code signatures / binary metadata, hard-capped at 80 tokens). When the agent
+actually needs the payload it pages through it with `tm_fetch`, using an
+HMAC-signed, run-scoped, expiring handle. `tm_bash` only allows read-only
+commands (allowlist), and failures come back as structured errors instead of
+raw dumps.
+
+**R6 environment protection (now an approval gate).** With TeamMode active,
+the model cannot read environment variables silently. Env-var reads
+(`printenv`, `env`, `Get-ChildItem env:`, …) and env files (`.env`, shell rc
+files) route through OpenCode's **official confirmation dialog**: you get a
+native prompt to approve or deny, and an unanswered prompt is **auto-rejected
+after `TM_ASK_TIMEOUT_MIN` (default 10 min)** — the plugin only ever rejects
+on timeout, never approves on the model's behalf. Env reads that no wildcard
+can express (embedded `$VAR` / `${VAR}` / `$env:` inside another command,
+command substitution, subshell/escaped forms) and the `tm_*` wrapper channel
+stay a **hard block** (no dialog to slip through). tm_* wrappers route through
+the same checks (no backdoor via the wrappers). Audit lines record only tool
+name + pattern category + the verdict (`ask` / `allowed-once` /
+`allowed-always` / `rejected` / `timeout-rejected` / `degraded`) — never
+command text, paths, variable names or values.
+
+**R2 dangerous operations (same dialog).** Delete (`rm`/`del`/`Remove-Item`/
+`rmdir`), git publishing (`git push`/`git commit`), network fetch (`curl`/
+`wget`/`Invoke-WebRequest`/`Invoke-RestMethod`), package installs/publishes
+(`npm install`/`npm publish`/`pip install`/`winget`/`choco`), process/system
+(`taskkill`/`Stop-Process`/`kill`/`shutdown`/`format`) and privilege changes
+(`chmod`/`takeown`/`icacls`) — none are silently allowed. They pop the same
+official dialog and are auto-rejected if you don't answer within the timeout.
+The normal verification stack (`npm test`, `tsc`, `git status`/`diff`) is NOT
+gated, so day-to-day team work runs without interruption.
+
+> ⚠️ **When you approve a dialog, pick "once" — not "always".** Verified on
+> the live host, "always" records a far broader rule than the command you
+> saw: approving `Get-ChildItem env:PATH` with "always" stores `Get-ChildItem
+> *`, so every later `Get-ChildItem` runs with no dialog at all. Only the
+> once-verdict keeps each gated operation individually human-checked.
+
+> Deferral is per-session: env reads only route to the dialog in sessions
+> running TeamMode's injected agents (or after such a session has shown one
+> of these dialogs). In any other session (e.g. a stock `build`/`plan` chat)
+> TeamMode's guard keeps hard-blocking env reads, since no dialog would back
+> them there. Compound commands (`a; b`) are evaluated per segment by the
+> host and approved through one dialog; the guard blocks them outright
+> whenever any segment is an env read.
+
+> The permission protocol was verified against a live `opencode serve` host
+> (1.18.29) via SSE event capture; the Desktop dialog rendering itself is the
+> one leg that still needs eyeballing in a real Desktop session. Headless
+> `opencode run` auto-rejects an unanswered `ask` immediately (there is no
+> human to prompt).
+
+| Env var | Default | Purpose |
+|---|---|---|
+| `TM_ENV_PROTECT` | `strict` | R6 mode: `strict` / `standard` / `off` (off also disarms the approval timer) |
+| `TM_ASK_TIMEOUT_MIN` | `10` | minutes before an unanswered R6/R2 confirmation dialog is auto-rejected; minimum 3 minutes (the host's `permission.replied` reaches the plugin ~120 s late on the event bus — shorter values would auto-reject a just-approved request) |
+| `TM_ENV_PROTECT_EXTRA_DENY` | — | extra block patterns (regex list; always a hard block, never dialog-governed) |
+| `TM_OFFLOAD_THRESHOLD` | `2000` | offload threshold (tokens, chars/4 estimate) |
+| `TM_PREVIEW_MAX_TOKENS` | `80` | preview hard cap |
+| `TM_FETCH_MAX_LINES` | `2000` | tm_fetch page cap |
+| `TM_BLACKBOARD_DIR` | `.blackboard/` | offloaded payload store |
+| `TM_TRAJECTORY_DIR` | `.trajectory/` | append-only tool-call ledger |
+| `TM_BLACKBOARD_TTL` | `7` | store retention (days) |
+| `TM_BASH_READONLY_ALLOWED` | built-in table | tm_bash allowlist |
+| `TM_PTC_MAX_PROGRAM_CHARS` | `4000` | PTC program source length cap (chars) |
+| `TM_PTC_MAX_CALLS` | `20` | PTC per-run bridge-call budget (1–200) |
+| `TM_PTC_MAX_ERRORS` | `3` | PTC per-run error budget (1–50) |
+| `TM_PTC_TIMEOUT_MS` | `60000` | PTC per-run wall-clock timeout (5s–10min) |
+| `TM_PTC_ENGINE` | `auto` | PTC engine: `auto` (worker→inline degrade) / `worker` / `inline` |
+
+---
+
+## ⚡ Batch orchestration (`tm_ptc_run`) — new in v1.5.2
+
+> Shipped in **v1.5.2** (2026-09-10).  Requires `@te-river/opencode-team-mode@1.5.2`
+> or later.
+
+`tm_ptc_run` lets a specialist agent write **one async program** that makes N
+governed `tm_*` calls in a single turn — zero LLM round-trips during the run,
+only an aggregation summary returns to context.  It is designed for batch
+read-only tasks: multi-file reconnaissance, bulk grep + read aggregation,
+cross-referencing search results.
+
+### How it works
+
+The agent writes a program body using `tm.read(args)`, `tm.grep(args)`,
+`tm.bash(args)`, `tm.fetch(args)` — same args as the four governed tools.
+Each call returns `{ok:true, data}` (governed: inline text or an offload
+handle) or `{ok:false, error:{tool,phase,line?,message}}`.  The program
+`return`s a value; it is JSON-serialized into the aggregation summary.
+
+Programs containing `require`, `import`, `process`, `globalThis`, `Deno`,
+`Bun`, `fs`, `net`, or `child_process` are rejected before execution (static
+pre-scan, auxiliary guard).
+
+### Budgets (tighten-only)
+
+The caller may tighten `max_calls`, `max_errors`, and `timeout_ms` — values
+above the `TM_PTC_*` ceilings are clamped down; values below the floor are
+clamped up.  Hitting any budget stops the whole run; produced output is NOT
+lost.
+
+### Engine (`TM_PTC_ENGINE`)
+
+| Mode | Behavior |
+|---|---|
+| `auto` (default) | Tries `worker_threads` first; on failure degrades to `node:vm` with a `degraded-engine` mark in the summary |
+| `worker` | Forces the worker engine (engine-error on failure) |
+| `inline` | Forces the `node:vm` engine (30s compile timeout for sync busy-loops; await-gap residual documented) |
+
+The worker engine runs the program in a dedicated thread with `env:{}`
+(process.env emptied), `resourceLimits`, and hard wall-clock `terminate()`.
+All governance (P2 path scope, P3 allowlist, R6, threshold offload, TTL)
+applies to every bridged call — PTC is not a bypass layer.
+
+### Access
+
+Five specialist agents (`implementer`, `tester`, `architect`, `reviewer`,
+`researcher`) have `tm_ptc_run` in their whitelist.  The `team` lead does
+not — it orchestrates, it does not run batch programs itself.
+
+---
+
 ## 🏗️ Architecture
 
 ```
@@ -258,14 +358,18 @@ opencode-team-mode/
 ├── package.json          ← npm package definition
 ├── tsconfig.json         ← TypeScript config
 ├── src/
-│   ├── index.ts          ← Plugin entry (server() + config hook, id: "team-mode")
+│   ├── index.ts          ← Plugin entry (server(): config + R6 tool.execute.before + approval-gate event + tool segment)
 │   ├── agents.ts         ← Agent definitions (prompts, modes, colors)
 │   ├── commands.ts       ← Command definitions (templates, agent bindings)
 │   ├── blackboard.ts     ← Shared blackboard + TTL auto-cleanup sweeper
+│   ├── envprotect.ts     ← R6 env-var read protection + R2 ask-pattern sets (dialog vs hard-block)
+│   ├── approval-gate.ts  ← Unified approval gate: host-dialog timeout auto-reject (never self-allows)
+│   ├── tm/               ← JIT layer-2 tools (tm_read / tm_grep / tm_bash / tm_fetch / tm_ptc_run)
 │   └── types.ts          ← Loader-contract type definitions (1.18.x)
 ├── scripts/
 │   ├── install.sh        ← One-click installer (bash)
 │   └── install.ps1       ← One-click installer (PowerShell)
+├── pt07/                 ← PT-07 baseline suite (seeded A/B token measurement)
 ├── LICENSE               ← Apache 2.0
 ├── README.md             ← English documentation
 └── README.zh-CN.md       ← Chinese documentation
@@ -274,8 +378,8 @@ opencode-team-mode/
 ### How it works
 
 1. OpenCode Desktop starts and loads `opencode.json(c)`.
-2. It sees `"@te-river/opencode-team-mode@1.4.9"` in the `plugin` array and loads the npm package.
-3. The loader calls the plugin's `server(input, options)`, which registers a `config` hook; the hook injects 6 agents and 6 commands into the merged config.
+2. It sees `"@te-river/opencode-team-mode@latest"` in the `plugin` array and loads the npm package.
+3. The loader calls the plugin's `server(input, options)`, which registers a `config` hook; the hook injects 6 agents and 6 commands into the merged config. The same call installs the R6 `tool.execute.before` guard, arms the unified R6/R2 approval gate (official dialog + `TM_ASK_TIMEOUT_MIN` auto-reject, wired through an `event` hook), and registers the governed `tm_*` tools (see [Context governance](#-context-governance-tm--r6--r2--new-in-v151) below).
 4. The plugin's `id: "team-mode"` is displayed as the plugin name in the Desktop UI.
 5. Agents and commands are immediately available in the Desktop UI — no file copying needed. User-defined agents with the same name always win (the plugin never clobbers them).
 
@@ -381,7 +485,7 @@ Default is **5 days**. To choose your own, use the tuple plugin form in
 {
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
-    ["@te-river/opencode-team-mode@1.4.9", { "ttlDays": 7 }]
+    ["@te-river/opencode-team-mode@latest", { "ttlDays": 7 }]
   ]
 }
 ```
@@ -405,7 +509,7 @@ team**):
 ```jsonc
 {
   "plugin": [
-    ["@te-river/opencode-team-mode@1.4.9", { "defaultAgent": false }]
+    ["@te-river/opencode-team-mode@latest", { "defaultAgent": false }]
   ]
 }
 ```

package/README.zh-CN.md

@@ -55,73 +55,40 @@ TeamMode 将 OpenCode 桌面版从一个单 Agent 编码助手，升级为**一
 
 ### 安装 TeamMode
 
-**方式 A — 一键安装脚本（推荐）：**
+**方式 A — 一键安装脚本：**
 
 macOS / Linux（bash）：
 ```bash
-curl -fsSL "https://gh-proxy.com/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.sh" | bash
+curl -fsSL https://ghproxy.net/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.sh | bash
 ```
 
 Windows（PowerShell）：
 ```powershell
-irm "https://gh-proxy.com/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.ps1" | iex
+irm https://ghproxy.net/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.ps1 | iex
 ```
 
-如果 gh-proxy 不可用，尝试 jsdelivr 或 GitHub 原始地址：
-```bash
-# macOS / Linux — jsdelivr
-curl -fsSL "https://cdn.jsdelivr.net/gh/Te-River/Opencode-TeamMode@main/scripts/install.sh" | bash
-
-# Windows — jsdelivr
-irm "https://cdn.jsdelivr.net/gh/Te-River/Opencode-TeamMode@main/scripts/install.ps1" | iex
-
-# macOS / Linux — GitHub 原始地址
-curl -fsSL https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.sh | bash
-
-# Windows — GitHub 原始地址
-irm https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.ps1 | iex
-```
-
-脚本会自动安装 npm 包，并将插件注册到你的 `opencode.jsonc` 中。
+**方式 B — 手动配置：**
 
-**方式 B — 手动 npm 安装：**
-
-```bash
-# 1. 安装插件包
-npm install -g @te-river/opencode-team-mode
-
-# 2. 将插件添加到 opencode.jsonc
-#    （见下方"配置"章节）
-```
-
-**方式 C — 本地开发安装（从本仓库）：**
-
-```bash
-git clone https://github.com/Te-River/Opencode-TeamMode.git
-cd Opencode-TeamMode
-npm install
-npm run build
-npm link
-```
-
----
-
-## ⚙️ 配置
-
-安装后，将插件添加到你的 `opencode.jsonc`：
+在你的 `opencode.jsonc` 中添加插件：
 
 ```jsonc
 {
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
-    "@te-river/opencode-team-mode@1.4.9"
+    "@te-river/opencode-team-mode@latest"
   ]
 }
 ```
 
-就这么简单。插件会在 OpenCode 启动时自动注入所有团队 Agent 和命令，**无需手动复制任何 Agent 文件或命令定义**。
+OpenCode 启动时会自动安装插件。
+
+> **提示：** 修改 `opencode.json` 后，**重启 OpenCode Desktop** 使配置生效。
 
-> 💡 **提示：** 修改 `opencode.json` 后，请**重启 OpenCode 桌面版**使更改生效。
+---
+
+## ⚙️ 配置
+
+插件会在 OpenCode 启动时自动注入所有团队 Agent 和命令，**无需手动复制任何 Agent 文件或命令定义**。
 
 > ⚠️ **模型选择很重要。** 工作流里的每一个判断——分诊、拆解、派单、
 > 整合、审查/测试闭环裁决——都经过 **Team Lead**。这个位置上放弱模型，
@@ -137,7 +104,7 @@ npm link
 {
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
-    "@te-river/opencode-team-mode@1.4.9"
+    "@te-river/opencode-team-mode@latest"
   ]
 }
 ```
@@ -246,6 +213,119 @@ team   完成。
 
 ---
 
+## 🧯 上下文治理（tm_* + R6 + R2）—— v1.5.1 起提供
+
+> ⚠️ 需 `@te-river/opencode-team-mode@1.5.1` 或更新（2026-09-08 发布）。
+> 配置里钉 `@latest` 的用户，下次启动自动升级。
+
+**JIT 层 2 工具（`tm_read` / `tm_grep` / `tm_bash` / `tm_fetch`）。**
+大体积工具输出是上下文成本的主要来源：智能体每走一步都要重发整个窗口。
+tm_* 工具先用受治理的管线执行内置能力：超过 `TM_OFFLOAD_THRESHOLD`
+token 的结果**不进窗口**——全量写入本地 run 存储，模型只拿一张句柄
+“提货单”，附内容感知预览（JSON 键结构 / CSV 表头+形状 / 日志
+ERROR×N 统计 / 代码签名清单 / 二进制元信息，硬上限 80 token）。
+确实需要全文时，用 HMAC 签名、限本 run、带有效期的句柄经 `tm_fetch`
+分段取回。`tm_bash` 仅放行只读命令白名单，失败以结构化错误返回。
+
+**R6 环境变量保护（现已升级为审批门控）。** TeamMode 激活时，模型无法
+静默读取环境变量。env 导出命令（`printenv`、`env`、`Get-ChildItem env:`
+等）与环境文件（`.env`、shell rc 文件）会走 OpenCode **官方确认弹窗**：
+你会在桌面收到一次原生确认，超过 `TM_ASK_TIMEOUT_MIN`（默认 10 分钟）
+无人响应即**自动拒绝**——插件超时只会拒绝，绝不为模型自我放行。通配符
+表达不了的形态（命令里内嵌的 `$VAR` / `${VAR}` / `$env:`、命令替换、
+子 shell/转义写法）以及 `tm_*` 包装通道仍维持**代码级硬拦**（没有弹窗
+可钻）。tm_* 包装工具同样过这套检查（不给包装层留后门）。审计日志只记
+工具名 + 模式类别 + 裁决事件（`ask` / `allowed-once` / `allowed-always` /
+`rejected` / `timeout-rejected` / `degraded`）——绝不记录命令文本、路径、
+变量名或值。
+
+**R2 危险操作（同一个确认弹窗）。** 删除（`rm`/`del`/`Remove-Item`/
+`rmdir`）、git 发布（`git push`/`git commit`）、网络（`curl`/`wget`/
+`Invoke-WebRequest`/`Invoke-RestMethod`）、包安装与发布（`npm install`/
+`npm publish`/`pip install`/`winget`/`choco`）、进程/系统（`taskkill`/
+`Stop-Process`/`kill`/`shutdown`/`format`）、权限（`chmod`/`takeown`/
+`icacls`）——都不再静默放行，而是弹同一个官方确认框，超时未响应即自动
+拒绝。日常验证栈（`npm test`、`tsc`、`git status`/`diff`）**不在**门控
+之列，团队协作照常无打扰运行。
+
+> ⚠️ **批准弹窗时请选 once（仅此一次），不要选 always。** 真实宿主实测：
+> always 记录的泛化规则远比当次命令宽——对 `Get-ChildItem env:PATH` 选
+> always 会记下 `Get-ChildItem *`，此后所有 `Get-ChildItem` 都不再弹窗。
+> 只有 once 能让每次危险操作继续单独过人手。
+
+> 延后是**按会话**生效的：只有运行 TeamMode 注入角色的会话（或已弹过这类
+> 确认框的会话）里的 env 读取才会被放行给弹窗；其他会话（如原生
+> `build`/`plan`）里守护仍然直接硬拦——那里根本没有弹窗兜底。宿主对复合
+> 命令（`a; b`）按段评估、单次弹窗批准整条；任一子段是 env 读取时守护整条
+> 拦截。
+
+> 权限协议已在真实 `opencode serve` 宿主（1.18.29）上经 SSE 事件捕获实测
+> 核验；桌面弹窗的渲染本身仍需在真实 Desktop 会话里目视确认一次。非交互
+> `opencode run` 下，无人应答的 `ask` 会被立即自动拒绝（没有人类可弹）。
+
+| 环境变量 | 默认 | 作用 |
+|---|---|---|
+| `TM_ENV_PROTECT` | `strict` | R6 模式：`strict` / `standard` / `off`（off 同时解除审批计时器） |
+| `TM_ASK_TIMEOUT_MIN` | `10` | R6/R2 确认弹窗无人应答后自动拒绝的分钟数；最小 3 分钟（宿主的 `permission.replied` 经事件总线到达插件约延迟 ~120 秒——更小的值会把刚获批的请求误拒） |
+| `TM_ENV_PROTECT_EXTRA_DENY` | — | 追加拦截正则（分号分隔；始终硬拦，不走弹窗） |
+| `TM_OFFLOAD_THRESHOLD` | `2000` | 卸载阈值（token，chars/4 估算） |
+| `TM_PREVIEW_MAX_TOKENS` | `80` | 预览硬上限 |
+| `TM_FETCH_MAX_LINES` | `2000` | tm_fetch 单段上限 |
+| `TM_BLACKBOARD_DIR` | `.blackboard/` | 卸载载荷存储 |
+| `TM_TRAJECTORY_DIR` | `.trajectory/` | 只追加工具调用账本 |
+| `TM_BLACKBOARD_TTL` | `7` | 存储保留天数 |
+| `TM_BASH_READONLY_ALLOWED` | 内置表 | tm_bash 只读白名单 |
+| `TM_PTC_MAX_PROGRAM_CHARS` | `4000` | PTC 程序源码长度上限（字符） |
+| `TM_PTC_MAX_CALLS` | `20` | PTC 单次运行桥接调用数上限（1–200） |
+| `TM_PTC_MAX_ERRORS` | `3` | PTC 单次运行错误数上限（1–50） |
+| `TM_PTC_TIMEOUT_MS` | `60000` | PTC 单次运行墙钟超时（5 秒–10 分钟） |
+| `TM_PTC_ENGINE` | `auto` | PTC 引擎：`auto`（worker→inline 降级）/ `worker` / `inline` |
+
+---
+
+## ⚡ 批量编排（`tm_ptc_run`）—— v1.5.2 起提供
+
+> 已随 **v1.5.2**（2026-09-10）发布。需 `@te-river/opencode-team-mode@1.5.2` 或更新。
+
+`tm_ptc_run` 让专家代理编写**一个异步程序**，在单次回合中执行 N 次受治理的
+`tm_*` 调用——运行期间零 LLM 往返，仅将聚合摘要返回上下文。设计用于批量
+只读任务：多文件侦察、批量 grep + read 聚合、交叉引用搜索结果。
+
+### 工作原理
+
+代理使用 `tm.read(args)`、`tm.grep(args)`、`tm.bash(args)`、`tm.fetch(args)`
+编写程序体——参数与四个受治理工具相同。每次调用返回 `{ok:true, data}`（已受
+治理：内联文本或卸载句柄）或 `{ok:false, error:{tool,phase,line?,message}}`。
+程序 `return` 一个值；它会被 JSON 序列化进聚合摘要。
+
+包含 `require`、`import`、`process`、`globalThis`、`Deno`、`Bun`、`fs`、`net`
+或 `child_process` 的程序会在执行前被拒绝（静态预扫描，辅助防护）。
+
+### 预算（仅收紧）
+
+调用方可收紧 `max_calls`、`max_errors` 和 `timeout_ms`——超过 `TM_PTC_*` 上限
+的值会被钳制到上限；低于下限的值会被钳制到下限。触达任一预算即整体停止运行；
+已产出的输出不会丢失。
+
+### 引擎（`TM_PTC_ENGINE`）
+
+| 模式 | 行为 |
+|---|---|
+| `auto`（默认） | 优先尝试 `worker_threads`；失败时降级为 `node:vm`，摘要标记 `degraded-engine` |
+| `worker` | 强制使用 worker 引擎（失败时返回 engine-error） |
+| `inline` | 强制使用 `node:vm` 引擎（30 秒编译超时斩杀同步忙等；await 间隙残余已记录） |
+
+worker 引擎在专用线程中运行程序，`env:{}` 清空 process.env、`resourceLimits`
+限量、硬墙钟 `terminate()`。所有治理（P2 路径范围、P3 白名单、R6、阈值卸载、
+TTL）对每次桥接调用生效——PTC 不是绕过层。
+
+### 访问权限
+
+五个专家代理（`implementer`、`tester`、`architect`、`reviewer`、`researcher`）
+的白名单中包含 `tm_ptc_run`。`team` lead 不包含——它负责编排，不运行批量程序。
+
+---
+
 ## 🏗️ 架构
 
 ```
@@ -253,14 +333,18 @@ opencode-team-mode/
 ├── package.json          ← npm 包定义
 ├── tsconfig.json         ← TypeScript 配置
 ├── src/
-│   ├── index.ts          ← 插件入口（server() + config hook，id: "team-mode"）
+│   ├── index.ts          ← 插件入口（server()：config + R6 tool.execute.before + 审批门 event 钩子 + tool 段）
 │   ├── agents.ts         ← Agent 定义（prompts、模式、颜色）
 │   ├── commands.ts       ← 命令定义（模板、Agent 绑定）
 │   ├── blackboard.ts     ← 共享黑板 + TTL 自动清理清扫器
+│   ├── envprotect.ts     ← R6 环境变量读取保护 + R2 确认弹窗模式集（弹窗 vs 硬拦）
+│   ├── approval-gate.ts  ← 统一审批门：官方弹窗超时自动拒绝（绝不自我放行）
+│   ├── tm/               ← JIT 层 2 工具（tm_read / tm_grep / tm_bash / tm_fetch / tm_ptc_run）
 │   └── types.ts          ← 加载器契约类型定义（1.18.x）
 ├── scripts/
 │   ├── install.sh        ← 一键安装脚本（bash）
 │   └── install.ps1       ← 一键安装脚本（PowerShell）
+├── pt07/                 ← PT-07 基线任务集（种子化 A/B token 测量）
 ├── LICENSE               ← Apache 2.0
 └── README.md             ← 英文文档
     README.zh-CN.md       ← 中文文档
@@ -269,8 +353,8 @@ opencode-team-mode/
 ### 工作原理
 
 1. OpenCode 桌面版启动，加载 `opencode.json(c)`
-2. 检测到 `plugin` 数组中的 `"@te-river/opencode-team-mode@1.4.9"`，加载 npm 包
-3. 加载器调用插件的 `server(input, options)`，注册 `config` hook；hook 向合并后的配置注入 6 个 Agent 和 6 个命令
+2. 检测到 `plugin` 数组中的 `"@te-river/opencode-team-mode@latest"`，加载 npm 包
+3. 加载器调用插件的 `server(input, options)`，注册 `config` hook；hook 向合并后的配置注入 6 个 Agent 和 6 个命令。同一次调用还会安装 R6 的 `tool.execute.before` 防护、武装 R6/R2 统一审批门（官方确认弹窗 + `TM_ASK_TIMEOUT_MIN` 超时自动拒绝，经 `event` 钩子驱动），并注册受治理的 `tm_*` 工具（见下文“上下文治理”）
 4. 插件的 `id: "team-mode"` 作为插件名显示在桌面版 UI
 5. Agent 和命令立即在桌面版 UI 中可用 —— 无需复制任何文件；同名 Agent 以用户自定义优先（插件绝不覆盖）
 
@@ -353,7 +437,7 @@ Team Lead 不再删除任务目录 —— 跑完的黑板原地留给你回看
 {
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
-    ["@te-river/opencode-team-mode@1.4.9", { "ttlDays": 7 }]
+    ["@te-river/opencode-team-mode@latest", { "ttlDays": 7 }]
   ]
 }
 ```
@@ -372,7 +456,7 @@ TeamMode 默认**把 Team 设为你的默认代理**——新会话直接由团
 ```jsonc
 {
   "plugin": [
-    ["@te-river/opencode-team-mode@1.4.9", { "defaultAgent": false }]
+    ["@te-river/opencode-team-mode@latest", { "defaultAgent": false }]
   ]
 }
 ```

package/dist/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AA0iB7C,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAO9C,CAAA"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAmB,MAAM,YAAY,CAAA;AAqpB9D,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAO9C,CAAA"}