@te-river/opencode-team-mode 1.6.2 → 1.7.0

package/scripts/gen-v2-config.mjs

@@ -29,9 +29,10 @@
  * Refuses to touch a file it did not generate unless --force is given.
  */
 
-import { mkdirSync, readFileSync, writeFileSync, existsSync } from "node:fs"
+import { mkdirSync, readFileSync, writeFileSync, existsSync, readdirSync, realpathSync, statSync } from "node:fs"
 import { join } from "node:path"
 import { homedir } from "node:os"
+import { pathToFileURL } from "node:url"
 
 const MARKER = "generated by @te-river/opencode-team-mode"
 
@@ -51,6 +52,11 @@ const { commands } = await import(new URL("../dist/commands.js", import.meta.url
 const { triplesFromAgentPermission, V1_ONLY_TOOLS } = await import(
   new URL("../dist/host/v2-permissions.js", import.meta.url).href
 )
+// Deletion goes through the repo's own safe remover: win32 `fs.rmSync` silently
+// no-ops on non-ASCII paths, and a reclaim that silently failed would leave the
+// duplicate role it exists to remove.  Same rule as every other destructive call
+// site in the plugin (src/fs-safe.ts).
+const { rmForceSafe } = await import(new URL("../dist/fs-safe.js", import.meta.url).href)
 
 /** YAML is a superset of JSON, so a JSON scalar is a valid YAML scalar —
  *  and the descriptions are full of em-dashes and colons that a hand-rolled
@@ -107,15 +113,15 @@ const body = (prompt) => {
  * and look like success.  `test-v2-adapter` group 8 pins both halves.
  */
 const V2_TEXT = [
-  ["tm_ptc_run program, keeping only the handle.", "`execute` (the host's Code Mode tool) program, keeping only the handle."],
-  ["Batch the recon in one tm_ptc_run program", "Batch the recon in one `execute` program"],
-  ["batch recon via tm_ptc_run,", "batch recon via `execute`,"],
-  ["is ONE tm_ptc_run, not a chain.", "is ONE `execute` (Code Mode) call, not a chain."],
-  ["multi-file batch recon → tm_ptc_run (one program,", "multi-file batch recon → `execute` (one program,"],
-  ["your FIRST move is ONE tm_ptc_run program:", "your FIRST move is ONE `execute` (Code Mode) program:"],
-  ["## Recon batching (PTC-first)", "## Recon batching (Code Mode first)"],
-  ["Local-repo recon is PTC-first:", "Local-repo recon is Code-Mode-first:"],
-  ["cross-referencing searches → ONE tm_ptc_run program", "cross-referencing searches → ONE `execute` program"],
+  /*
+   * The efficiency / file-ladder / pty sentences are NOT here any more: the
+   * shared source prompts now say the v2 thing natively (`execute` for batch
+   * recon, the native read / grep / glob / shell for retrieval, `shell
+   * {background:true}` for slow steps), because this package ships one
+   * personality and a translation table is the wrong place to hold the only
+   * correct wording.  What is left below is what genuinely still differs
+   * between what the source says and what this host offers.
+   */
   /*
    * The delegation half of the lead prompt.  On v2 the host's tool is named
    * `subagent` — measured, not inferred: a live dispatch reached
@@ -125,7 +131,9 @@ const V2_TEXT = [
    * `background` needs no operator flag — the plugin sets it on every dispatch —
    * so the "pick the shape by rule" instruction is not a choice the model has.
    */
-  ["## Delegation — the host's task tool, and what you do while it runs", "## Delegation — the host's subagent tool, and what you do while it runs"],
+  /* The section heading says `subagent` in the SOURCE now (the v1 personality is
+   * gone, so nothing reads a v1 wording any more); the fork below still carries
+   * the sentences whose v1 shape differs in more than the tool name. */
   ["delegation goes through the host's `task` — governed, visible, killable.", "delegation goes through the host's `subagent` — governed, visible, killable."],
   ["you will keep following up while they run → `task { background: true }`: the", "you will keep following up while they run → `subagent { background: true }`: the"],
   ["`task`. Do not choose background when you would only park waiting for it.",
@@ -137,46 +145,10 @@ const V2_TEXT = [
   ["a background `task` names its own session id", "a background `subagent` names its own session id"],
   ["a synchronous `task` call, so chaining waits", "a synchronous `subagent` call, so chaining waits"],
   ["blocking on `task`", "blocking on `subagent`"],
-  /*
-   * The file ladder (the tm_read / tm_grep / tm_bash retirement).  v2 does not
-   * register those three, so every sentence that routes a role through them has
-   * to name what is actually on the surface instead — and the native tools are
-   * NOT ungoverned here: `execute.after` offloads their oversized results, and
-   * the address / R6 red lines ride `permission.evaluate` (both landed BEFORE
-   * this fork, which is the ordering the retirement requires).
-   *
-   * Two words are host-vocabulary, not ours: v2 names the shell tool `shell`,
-   * and its `background` argument is documented on the native tool (AGENTS.md,
-   * "native shell … has background:true").  The pty line is rewritten around
-   * that, NOT around anything I have measured in a live v2 session — a v2
-   * session has yet to make a background shell call, and #8/#9 are where that
-   * gets checked.  Until then the sentence says only "returns at once".
-   */
-  ["tm_grep / tm_read first, a second lookup only for what it genuinely missed.", "grep / read first, a second lookup only for what it genuinely missed."],
-  ["All file reads / searches / enumeration go through tm_read / tm_grep / tm_bash.\nThe built-in read/grep/glob/list tools are removed from the tool surface —\nretrying them only wastes a turn.  Built-in bash exists only where granted\n(team / implementer / reviewer / tester run commands: build / test / git);\narchitect and researcher have no bash at all — one-off read-only commands\ngo through tm_bash or are reported as a gap.",
-   "File reads / searches / enumeration go through the built-in read / grep /\nglob tools — on this host they ARE the governed path: an oversized result comes\nback as a short preview plus a handle, and `tm_fetch` pages the rest, so a wide\ncall is cheap here and still the right move.  Built-in shell exists only where\ngranted (team / implementer / reviewer / tester run commands: build / test /\ngit); architect and researcher have no shell at all — a one-off read-only\ncommand they cannot run is reported as a gap, not retried."],
-  ["code search → tm_grep · enumeration and quick\n  probes → tm_bash · multi-file", "code search → grep · enumeration and quick\n  probes → glob / shell where granted · multi-file"],
-  ["use the **built-in bash** tool — not tm_bash.  tm_bash hard-blocks them with\nno dialog; built-in bash triggers the official confirmation dialog (once /\nalways / reject).  Dangerous commands (rm / git push / npm publish / etc.)\nalways trigger the dialog regardless of tool.",
-   "there is no second, ungoverned shell to fall back to on this host: the one\n**shell** tool IS the R6 surface, and its classifier only ever makes a rule\nstricter — an env dump or a delete asks the host, which opens its own dialog\n(once / always / reject).  Dangerous commands (rm / git push / npm publish /\netc.) ask regardless of what the config said."],
-  ["probes toward one goal — tm_read / tm_grep / tm_bash\nOR built-in bash alike — your FIRST move is ONE", "probes toward one goal — read / grep / glob / shell alike — your FIRST move is ONE"],
-  ["Plain shell probes the governed channel cannot run\n(e.g. env-path checks, which the tm_* channel hard-blocks by\ndesign) go as ONE compound built-in bash command (`a; b; c` in a\nsingle call)",
-   "Several cheap probes of one kind go as ONE compound `shell`\ncommand (`a; b; c` in a\nsingle call)"],
-  ["searches are PTC work;", "searches are one-program work;"],
-  ["(tm.read / tm.grep / tm.bash ride inside; ALWAYS `return` the", "(the built-in read / grep / shell tools are callable inside it; ALWAYS `return` the"],
-  ["(or one PTC program), never in two.", "(or one `execute` program), never in two."],
-  ["run one cheap tm_grep.  Do NOT pull big payloads", "run one cheap grep.  Do NOT pull big payloads"],
-  ["or tm_grep + tm_bash yourself)", "or grep + shell yourself)"],
-  ["into its OWN tm_pty session (returns at once, the user sees the terminal,\n  every start passes the official dialog) rather than being chained with\n  `;` behind one long bash call.  tm_pty returns no transcript — tee it to\n  a log and read that log when it reports exited.",
-   "into its OWN separate `shell` call rather than being chained with\n  `;` behind one long shell call — and when the step is genuinely slow, use\n  `shell {background:true}`: the ack gives a shell ID plus the file its output\n  streams to, and the host notifies on exit (do NOT poll for it).  Have it write\n  its own log file and read that log when it reports exited — do not re-run the\n  command to see its output."],
-  ["probes via bash where granted) BEFORE answering from memory.", "probes via shell where granted) BEFORE answering from memory."],
   ["FIRST there, because that is the only path with the domain allowlist, the\nper-request dialog and the R6 red lines; an MCP fetcher of the same page\nsilently skips all three (and dumps raw HTML into your context).  Fall to a",
    "FIRST there, because that is the only path with the address red line (no\nmetadata / private-range fetch) and the threshold offload; an MCP fetcher of the\nsame page silently skips both (and dumps raw HTML into your context).  Fall to a"],
-  ["- Files/docs → tm_read · code search →", "- Files/docs → read · code search →"],
-  ["  --help) → built-in bash where granted ·", "  --help) → `shell` where granted ·"],
-  ["## PTC batch orchestration", "## Batch orchestration (Code Mode first)"],
   ["file tool at all (architect and researcher have no write/edit/bash; reviewer\n  has only the read-only bash, which refuses redirection). Pass the `session`",
    "file tool at all (architect and researcher have no write / edit / shell, and\n  reviewer's shell is the host's own, classified per command). Pass the `session`"],
-  ["- The host stops a bash command after 120 s unless you pass a larger", "- The host stops a shell command after 120 s unless you pass a larger"],
   /*
    * The LEDGER.  v2 gives a plugin no `todowrite` (V2_ONLY_ACTIONS names it as a
    * key with no v2 counterpart), so the mandate's tool is the one this plugin
@@ -202,33 +174,12 @@ const V2_TEXT = [
   ["Do NOT store task state or oversized content there — todo list and\nboard files own those.",
    "Do NOT store task state or oversized content there — the lead's `tm_ledger`\nand board files own those."],
   ["dropped: the list is the user's audit surface (pending / in_progress /\n  completed / blocked)", "dropped: the list is the user's audit surface (open / doing /\n  done / blocked — `tm_ledger` keeps the states, and `blocked` carries the note\n  naming what blocked it)"],
-  /* tm_pty is v1-only on purpose: `client.pty` does not exist on the v2 plugin
-   * ctx, so the tool could only ever answer "pty 接口不可用".  The v2 rules now DO name a
-   * replacement, because #28 measured it out of the 2.0.16 build
-   * (docs/research/v2-builtin-tools.md §2.5): `shell` takes `background:true`, the ack is
-   * "Command moved to the background (shell ID: X)" plus the file the output streams to,
-   * the host says DO NOT poll, and completion returns later as a synthetic
-   * `<shell id=… state=… command=…>` message.  `shell` and `subagent` are the ONLY two
-   * built-ins with a background parameter, which is also why tm_pty stays retired: the pty
-   * REST surface is still absent, and the native path has no per-command dialog (and its
-   * completion envelope re-enters context carrying the command text — an R6 touchpoint). */
-  ["either: give each its own call, or run it through tm_pty (non-blocking,\n  where granted) and check `status` later.  A tm_pty session writes no\n  transcript back to you, so tee its output to a file (`<cmd> 2>&1 | tee\n  <log>`) and read that file for EVIDENCE once it reports exited.",
-   "either: give each its own call, or run it through `shell` with\n  `background:true` (it returns at once with a shell ID and the file its output\n  streams to, and the host notifies you when it exits — so do NOT poll, and never\n  re-run the command to watch it pass again).  Either way tee the output\n  (`<cmd> 2>&1 | tee\n  <log>`) and read that log for EVIDENCE."],
-  /* Option A (user decision 2026-09-25): interactive browsing goes to the host's own
-   * browser_* tools, because that is the only browser the desktop renders in its side
-   * panel (docs/research/browser-pane.md).  Governance is NOT taken off the table: the gate
-   * lives in src/host/v2-browser-gate.ts (execute.before + a leak-detected fallback that
-   * replaces the page with the refusal), and snapshots stay addressable through
-   * capKeepingAddressing.  tm_browser stays named as the fallback for a host with no
-   * desktop browser (CLI / standalone server).  Every key below must match the v1 prompt
-   * byte-exactly: assertForkApplied() throws when one stops matching. */
-  ["  URLs → tm_webfetch, JS-rendered pages → tm_browser (network roles only).", "  URLs → tm_webfetch, JS-rendered pages → the host's own browser_* tools (they drive\n  the side panel the user can actually see), falling back to tm_browser when no desktop browser is connected (network roles only)."],
-  ["- a visual state (a rendered UI, a chart) → tm_browser", "- a visual state (a rendered UI, a chart) → the host's browser_* tools (browser_tabs_open → browser_snapshot → browser_screenshot), or tm_browser when they are not offered"],
-  ["## UI verification (tm_browser — you carry it)", "## UI verification (the host's browser_* tools — you carry them)"],
-  ["For user-visible frontend changes, verify through the governed tm_browser", "For user-visible frontend changes, verify through the host's own browser_* tools (tm_browser only when they are absent)"],
-  ["If tm_browser is unavailable on this host, the action you need is not", "If neither browser_* nor tm_browser is available on this host, the action you need is not"],
-  ["  via your governed tm_search / tm_browser / tm_webfetch first,", "  via your governed tm_search / tm_webfetch and the host's browser_* tools (or tm_browser when no desktop browser is connected) first,"],
-  ["  lookups: governed tm_search / tm_browser / tm_webfetch first, then user MCP tools.", "  lookups: governed tm_search / tm_webfetch + the host's browser_* tools first, then user MCP tools."],
+  /* The browser fork entries are GONE (user decision 2026-10-06): the self-built
+   * tm_browser was removed outright, so the shared source prompts now name the
+   * host's native browser_* tools natively and there is nothing left to fork.
+   * Governance is unchanged: the gate lives in src/host/v2-browser-gate.ts
+   * (execute.before + a leak-detected fallback that replaces the page with the
+   * refusal), and snapshots stay addressable through capKeepingAddressing. */
 ]
 
 function forkBody(text, hits) {
@@ -278,27 +229,228 @@ function emit(dir, name, content) {
   written.push(file)
 }
 
-const agentsDir = join(baseDir, "agents")
-const forkHits = new Set()
-for (const [id, cfg] of Object.entries(agents)) {
-  const { triples } = triplesFromAgentPermission(cfg.permission, { escalateShellAsk: false, agentName: id })
-  // An `allow` for a tool v2 never registers would claim a capability that does
-  // not exist; V1_ONLY_TOOLS is the same set v2.ts skips when registering.
-  const v2Triples = triples.filter((t) => !V1_ONLY_TOOLS.has(t.action))
-  const text = forkBody(body(cfg.prompt), forkHits)
-  emit(agentsDir, id, agentFrontmatter(cfg, v2Triples) + text + "\n")
+const reclaimed = []
+const keptForeign = []
+const caseNotes = []
+const unverified = []
+
+/** Windows is case-insensitive: `team.md` and `Team.md` are ONE file, and
+ *  `realpathSync` echoes the case it was GIVEN rather than the on-disk case, so
+ *  a real-path comparison must fold case on win32 — otherwise the reclaim would
+ *  delete the very file it just wrote. */
+const normPath = (p) => (process.platform === "win32" ? p.toLowerCase() : p)
+
+/**
+ * The identity of a file as the OS reports it, or null when `statSync` fails.
+ * `dev` + `ino` together name a file on POSIX and on macOS (APFS), where the
+ * inode is stable across case spellings of the same name.  Windows is the
+ * exception: some Node/FS combinations report `ino: 0` for every file, so a
+ * zero inode is treated as "unavailable" rather than as a real identity.
+ */
+export function statIdentity(p) {
+  try {
+    const st = statSync(p)
+    return { dev: Number(st.dev), ino: Number(st.ino) }
+  } catch {
+    return null
+  }
 }
-assertForkApplied(forkHits)
 
-const commandsDir = join(baseDir, "commands")
-for (const [name, cfg] of Object.entries(commands)) {
-  emit(commandsDir, name, commandFrontmatter(cfg) + body(cfg.template) + "\n")
+/**
+ * Pure file-identity verdict from two stat identities (or null when a stat
+ * failed).  Returns:
+ *   "same"      — dev+ino both match: the two paths ARE one file
+ *   "different" — dev+ino both usable and differ: two distinct files
+ *   "fallback"  — inode unavailable (Windows reports 0): the caller may fall
+ *                 back to a case-folded real-path comparison
+ *   "unknown"   — inode unavailable on a non-Windows platform: we CANNOT tell,
+ *                 so the caller must keep the file (fail-safe)
+ *
+ * The macOS trap this exists for: APFS is case-INSENSITIVE but case-PRESERVING,
+ * so `Team.md` and `team.md` are one file while `realpathSync` may echo the
+ * spelling it was given.  A real-path comparison would then call them different
+ * and delete the file that was just written.  dev+ino is the platform-neutral
+ * answer; when it is unavailable we refuse to delete rather than guess (#48).
+ */
+export function identityVerdict(a, b, platform) {
+  const usable = (x) => x != null && Number.isFinite(x.ino) && x.ino !== 0
+  if (usable(a) && usable(b)) {
+    return a.dev === b.dev && a.ino === b.ino ? "same" : "different"
+  }
+  return platform === "win32" ? "fallback" : "unknown"
 }
 
-console.log(`目标：${agentsDir} 与 ${commandsDir}`)
-for (const f of written) console.log(printOnly ? `将写入 ${f}` : `已写入 ${f}`)
-for (const s of skipped) console.log(`跳过 ${s}`)
-console.log(
-  `\n共 ${written.length} 个文件（角色 ${Object.keys(agents).length} + 命令 ${Object.keys(commands).length}）` +
-    `${printOnly ? "（--print，未落盘）" : ""}。重启桌面端（或 opencode reload）后 Team 出现在 agent 选择器、/team-* 出现在命令列表。`,
-)
+/**
+ * After a deletion, every file in the keep set must still be on disk.  A
+ * vanished target means the reclaim deleted the file it just wrote — the
+ * install is broken and must NOT look like success, so the caller prints the
+ * error and exits non-zero.  Pure over the `exists` predicate so it is testable
+ * without touching the filesystem.
+ */
+export function verifyKeepIntact(keepPaths, exists = existsSync) {
+  const missing = keepPaths.filter((p) => !exists(p))
+  return { ok: missing.length === 0, missing }
+}
+
+/**
+ * The #48 fail-safe's reporting half: a target that vanished during the reclaim
+ * means the install is broken, so it must be LOUD and must not exit 0.  Exported
+ * so the test can drive the exact sentence and the exit code without having to
+ * manufacture a filesystem that defeats the identity guard.
+ */
+export function reportKeepLoss(missing) {
+  console.error(`错误：回收后目标文件消失，安装已中止（#48 fail-safe）：${missing.join(", ")}`)
+  process.exitCode = 1
+}
+
+/**
+ * Reclaim role/command files this generator wrote in a PREVIOUS run but no
+ * longer emits — the `team.md` → `Team.md` rename (#47) is the case that
+ * motivated it.  On a case-sensitive filesystem (Linux) the old lowercase file
+ * survives beside the new one and the host loads TWO Team roles; on a
+ * case-insensitive filesystem (Windows, and macOS/APFS by default) the two names
+ * are one file, so there is nothing to reclaim and deleting would delete the
+ * target.
+ *
+ * Strict rules:
+ *  - only a file carrying MARKER is ours to remove; a hand-written file with a
+ *    stale name is left alone and REPORTED, never silently kept.
+ *  - "is this the file we just wrote?" is answered by dev+ino first (reliable on
+ *    POSIX and macOS), then by a case-folded real path on win32 only.  When
+ *    neither can answer, the file is KEPT and reported — a duplicate role is a
+ *    far smaller failure than a deleted target (#48).
+ *  - after every deletion the keep set is re-checked; a vanished target prints
+ *    an error and sets a non-zero exit code.
+ *  - deletion goes through rmForceSafe (dist/fs-safe.js): win32 fs.rmSync
+ *    silently no-ops on non-ASCII paths, and a reclaim that silently failed
+ *    would leave the duplicate role it exists to remove.
+ */
+function reclaimStale(dir, keepNames, label) {
+  if (!existsSync(dir)) return
+  const keep = new Set(keepNames.map((n) => `${n}.md`))
+  const keepPaths = []
+  const keepId = new Map()
+  for (const n of keep) {
+    const p = join(dir, n)
+    if (!existsSync(p)) continue
+    keepPaths.push(p)
+    keepId.set(n, statIdentity(p))
+  }
+  for (const entry of readdirSync(dir)) {
+    if (!entry.endsWith(".md")) continue
+    if (keep.has(entry)) continue
+    const file = join(dir, entry)
+    const fileId = statIdentity(file)
+    // Decide "same file as a target?" per keep entry, most reliable test first.
+    let sameAs = null
+    let undecidable = false
+    for (const n of keep) {
+      if (!keepId.has(n)) continue
+      const verdict = identityVerdict(fileId, keepId.get(n), process.platform)
+      if (verdict === "same") {
+        sameAs = n
+        break
+      }
+      if (verdict === "fallback") {
+        // win32 with no usable inode: compare case-folded real paths.
+        try {
+          if (normPath(realpathSync(file)) === normPath(realpathSync(join(dir, n)))) {
+            sameAs = n
+            break
+          }
+        } catch {
+          undecidable = true
+        }
+      } else if (verdict === "unknown") {
+        undecidable = true
+      }
+    }
+    if (sameAs) {
+      // Same file as a target, stored under a different case.  There is nothing
+      // stale here, and deleting it would delete the file we just wrote.
+      caseNotes.push(`保留 ${file} — 与目标 ${sameAs} 是同一个文件（本机不区分大小写），未删除`)
+      continue
+    }
+    if (undecidable) {
+      // Neither dev+ino nor a real-path comparison could decide.  Fail safe:
+      // keep the file and say so — a duplicate role beats a deleted target.
+      unverified.push(`保留 ${file} — 无法确认是否与目标 ${[...keep].join(" / ")} 是同一文件，保留不删`)
+      continue
+    }
+    let current
+    try {
+      current = readFileSync(file, "utf8")
+    } catch {
+      continue
+    }
+    if (!current.includes(MARKER)) {
+      keptForeign.push(`保留 ${file} — 不是我生成的（无标记），请自行决定`)
+      continue
+    }
+    if (printOnly) {
+      reclaimed.push(`回收 ${file} — 本次不再生成该${label}（--print，未落盘）`)
+      continue
+    }
+    rmForceSafe(file)
+    if (existsSync(file)) {
+      reclaimed.push(`回收失败 ${file} — 仍在磁盘上，请手动删除`)
+    } else {
+      reclaimed.push(`回收 ${file} — 本次不再生成该${label}（旧文件已清理）`)
+    }
+    // #48: a deletion must never take a target with it.  Re-check the keep set
+    // after EVERY real deletion; a vanished target is a broken install.
+    const intact = verifyKeepIntact(keepPaths)
+    if (!intact.ok) {
+      reportKeepLoss(intact.missing)
+      return
+    }
+  }
+}
+
+function main() {
+  const agentsDir = join(baseDir, "agents")
+  const forkHits = new Set()
+  for (const [id, cfg] of Object.entries(agents)) {
+    const { triples } = triplesFromAgentPermission(cfg.permission, { escalateShellAsk: false, agentName: id })
+    // An `allow` for a tool v2 never registers would claim a capability that does
+    // not exist; V1_ONLY_TOOLS is the same set v2.ts skips when registering.
+    const v2Triples = triples.filter((t) => !V1_ONLY_TOOLS.has(t.action))
+    const text = forkBody(body(cfg.prompt), forkHits)
+    emit(agentsDir, id, agentFrontmatter(cfg, v2Triples) + text + "\n")
+  }
+  assertForkApplied(forkHits)
+  // Reclaim role files a previous run wrote under a name this run no longer emits
+  // (the `team.md` → `Team.md` rename, #47).  Runs AFTER the writes so the keep
+  // set is the current output, and the identity guard keeps it from deleting a
+  // file it just wrote on a case-insensitive filesystem.
+  reclaimStale(agentsDir, Object.keys(agents), "角色")
+
+  const commandsDir = join(baseDir, "commands")
+  for (const [name, cfg] of Object.entries(commands)) {
+    emit(commandsDir, name, commandFrontmatter(cfg) + body(cfg.template) + "\n")
+  }
+  // Same pass for commands.  No command name has changed yet, so this is a no-op
+  // today — it is here so a future rename is closed by the same mechanism rather
+  // than by a second, hand-written reclaim that could drift from this one.
+  reclaimStale(commandsDir, Object.keys(commands), "命令")
+
+  console.log(`目标：${agentsDir} 与 ${commandsDir}`)
+  for (const f of written) console.log(printOnly ? `将写入 ${f}` : `已写入 ${f}`)
+  for (const s of skipped) console.log(`跳过 ${s}`)
+  for (const r of reclaimed) console.log(r)
+  for (const k of keptForeign) console.log(k)
+  for (const c of caseNotes) console.log(c)
+  for (const u of unverified) console.log(u)
+  console.log(
+    `\n共 ${written.length} 个文件（角色 ${Object.keys(agents).length} + 命令 ${Object.keys(commands).length}）` +
+      `${printOnly ? "（--print，未落盘）" : ""}。重启桌面端（或 opencode reload）后 Team 出现在 agent 选择器、/team-* 出现在命令列表。`,
+  )
+  if (unverified.length) {
+    console.log(`注意：${unverified.length} 个文件无法确认是否与目标同一文件，已保留不删（#48 fail-safe）。`)
+  }
+}
+
+// Run only when invoked as a script.  Importing this module (the test suite
+// does, to exercise the pure identity helpers) must NOT write to the user's
+// real config directory — the default `--dir` is `~/.config/opencode`.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) main()

package/scripts/lib/fake-ctx.mjs

@@ -20,6 +20,7 @@ export function makeFakeCtx({
   agents: seedAgents = [],
   tools: seedTools = [],
   sessionData = null,
+  models: seedModels = null,
 } = {}) {
   const registrations = []
   const hooks = new Map()
@@ -70,6 +71,30 @@ export function makeFakeCtx({
   const errorLines = []
   /** #33: which child sessions a stop attempt actually reached, in order. */
   const stopCalls = []
+  /** #steer: what each interjection seam actually received, args and all.  A test that
+   *  only read the tool's prose could not tell 插话给了子会话 from 插话给了调用者自己,
+   *  and that distinction is the whole safety property of the feature. */
+  const promptCalls = []
+  const syntheticCalls = []
+  const inboxListCalls = []
+  const inboxCancelCalls = []
+  /** #39: the compaction admissions the fake actually received, and how many times the
+   *  catalog was listed. A test that only read the layer's own counters could not tell
+   *  "we asked the host to compact" from "we decided to and told nobody". */
+  const compactCalls = []
+  const modelListCalls = []
+
+  /** Turn a seeded verdict into a host-shaped method: a function is called with the args
+   *  (so a test can answer per-session), an Error throws, anything else is returned as-is.
+   *  Same construction as `stop` above — a fake that always answered `true` would let the
+   *  tool claim 已受理 against a host that never admitted anything. */
+  const verdictMethod = (seed, logArr) => async (args = {}) => {
+    logArr.push({ ...(args ?? {}) })
+    const v = typeof seed === "function" ? seed(args) : seed
+    if (v instanceof Error) throw v
+    return v
+  }
+  const has = (key) => sessionData && Object.prototype.hasOwnProperty.call(sessionData, key)
 
   return {
     ctx: {
@@ -119,9 +144,51 @@ export function makeFakeCtx({
                   },
                 }
               : {}),
+            // #steer — the interjection seams, seeded ONLY when a test asks for them, for
+            // the same reason `interrupt` is: a host that never admits inbox input must not
+            // be able to be described as having accepted one.  `prompt` is the documented
+            // `{sessionID, text, delivery}` call; `synthetic` is the fallback seam; the
+            // inbox ops exist in TWO spellings (nested `session.inbox.list`, which the
+            // published operation ids imply, and flat `session["inbox.list"]`), and
+            // `inboxFlat` lets a test drive the fallback and pin which one answered.
+            ...(has("prompt") ? { prompt: verdictMethod(sessionData.prompt, promptCalls) } : {}),
+            // #39 — `compact` is seeded ONLY when a test asks for it, for the same reason
+            // as `interrupt`: the 2.0.23 probe proved the seam exists (`compact({})` →
+            // Missing key at ["sessionID"]), but a fake that always had it would let the
+            // layer claim a host that has none.
+            ...(has("compact") ? { compact: verdictMethod(sessionData.compact, compactCalls) } : {}),
+            ...(has("synthetic") ? { synthetic: verdictMethod(sessionData.synthetic, syntheticCalls) } : {}),
+            ...(has("inbox") && sessionData.inbox && !sessionData.inboxFlat
+              ? {
+                  inbox: {
+                    ...(sessionData.inbox.list !== undefined
+                      ? { list: verdictMethod(sessionData.inbox.list, inboxListCalls) }
+                      : {}),
+                    ...(sessionData.inbox.cancel !== undefined
+                      ? { cancel: verdictMethod(sessionData.inbox.cancel, inboxCancelCalls) }
+                      : {}),
+                  },
+                }
+              : {}),
+            ...(has("inbox") && sessionData.inbox && sessionData.inboxFlat
+              ? {
+                  "inbox.list": verdictMethod(sessionData.inbox.list, inboxListCalls),
+                  "inbox.cancel": verdictMethod(sessionData.inbox.cancel, inboxCancelCalls),
+                }
+              : {}),
           }
         : { hook: mkHook("session") },
       shell: { hook: mkHook("shell") },
+      // `model.list()` measured on 2.0.23: `{location, data:[{id, modelID, providerID,
+      // …, limit:{context, output}}]}`. The shape below is that shape, because the early
+      // compaction layer reads `limit.context` as the denominator and a fake with a
+      // friendlier shape would test the reading, not the contract.
+      model: {
+        async list(opts = {}) {
+          modelListCalls.push({ ...(opts ?? {}) })
+          return { location: { directory }, data: seedModels ?? [] }
+        },
+      },
       storage: {
         _map: new Map(),
         async get(k) { return this._map.get(k) },
@@ -150,6 +217,14 @@ export function makeFakeCtx({
     /** #33 — the stop attempts this fake actually received, so a test can pin that a
      *  cancel reached the host with the child's id rather than trusting the tool's prose. */
     stopCalls,
+    /** #steer — the same for the interjection seams: the args each one really got. */
+    promptCalls,
+    syntheticCalls,
+    inboxListCalls,
+    inboxCancelCalls,
+    /** #39 — the compaction admissions and the catalog reads, with their args. */
+    compactCalls,
+    modelListCalls,
   }
 }