@x-otto/cli 0.0.1-alpha.49 → 0.0.1-alpha.50

package/dist/{auth-command-D1T16ed-.js → auth-command-BYaFM76w.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{t as e}from"./create-host-app-BXQ8bU-B.js";import{createDefaultAuthStore as t}from"@x-otto/ai";import{createInterface as n}from"node:readline/promises";async function r(n,i={}){if(!i.authStore&&i.bootstrap){let t=e({workspaceDir:i.bootstrap.workspaceDir,projectConfigPath:i.bootstrap.projectConfigPath,logger:{name:`otto-auth`,level:i.bootstrap.verbose?`debug`:`info`,destination:`stderr`}});try{return await t.start(),await r(n,{...i,authStore:t.authStore,bootstrap:void 0})}finally{await t.stop()}}let s=i.stdout??(e=>process.stdout.write(e)),l=i.stderr??(e=>process.stderr.write(e)),u=i.authStore??t({watchForExternalChanges:!1}),[d,f]=n;switch(d){case`login`:return a(u,f,{stdout:s,stderr:l,prompt:i.prompt});case`logout`:return o(u,f,{stdout:s,stderr:l});case`status`:case void 0:return c(u,{stdout:s});default:return l(`otto auth: unknown action '${d}'. Use login | status | logout.\n`),1}}function i(e){return e.oauth.list().map(e=>e.id)}async function a(e,t,r){let a=i(e);if(a.length===0)return r.stderr(`otto auth login: no OAuth-capable providers available yet.
+import{t as e}from"./create-host-app-CbJ8ptv-.js";import{createDefaultAuthStore as t}from"@x-otto/ai";import{createInterface as n}from"node:readline/promises";async function r(n,i={}){if(!i.authStore&&i.bootstrap){let t=e({workspaceDir:i.bootstrap.workspaceDir,projectConfigPath:i.bootstrap.projectConfigPath,logger:{name:`otto-auth`,level:i.bootstrap.verbose?`debug`:`info`,destination:`stderr`}});try{return await t.start(),await r(n,{...i,authStore:t.authStore,bootstrap:void 0})}finally{await t.stop()}}let s=i.stdout??(e=>process.stdout.write(e)),l=i.stderr??(e=>process.stderr.write(e)),u=i.authStore??t({watchForExternalChanges:!1}),[d,f]=n;switch(d){case`login`:return a(u,f,{stdout:s,stderr:l,prompt:i.prompt});case`logout`:return o(u,f,{stdout:s,stderr:l});case`status`:case void 0:return c(u,{stdout:s});default:return l(`otto auth: unknown action '${d}'. Use login | status | logout.\n`),1}}function i(e){return e.oauth.list().map(e=>e.id)}async function a(e,t,r){let a=i(e);if(a.length===0)return r.stderr(`otto auth login: no OAuth-capable providers available yet.
 Install a provider plugin first — run \`otto\` (interactive) for guided setup,
 or: otto extension install anthropic-provider
 `),1;if(!t)return r.stderr(`otto auth login: missing provider. One of: ${a.join(`, `)}\n`),1;let o=e.oauth.get(t);if(!o)return r.stderr(`otto auth login: unknown provider '${t}'. One of: ${a.join(`, `)}\n`),r.stderr(`Hint: plugin providers (cursor, anthropic, …) need the plugin installed with provider capability granted.
@@ -8,4 +8,4 @@ or: otto extension install anthropic-provider
 `),1;let s=r.prompt?void 0:n({input:process.stdin,output:process.stdout}),c=r.prompt??(e=>s.question(e)),l=new AbortController,u=()=>l.abort();process.on(`SIGINT`,u);try{let n={onAuth:e=>{r.stdout(`\nOpen this URL in your browser to authorize:\n  ${e.url}\n`),e.code&&r.stdout(`Code: ${e.code}\n`),e.instructions&&r.stdout(`${e.instructions}\n`)},onPrompt:async e=>{let t=e.placeholder?` (${e.placeholder})`:``;return(await c(`${e.message}${t}: `)).trim()},onManualCode:async e=>{let t=c(`
 Paste the code here: `).then(e=>e.trim(),()=>``);return e?e.aborted?``:Promise.race([t,new Promise(t=>{e.addEventListener(`abort`,()=>t(``),{once:!0})})]):t},onProgress:e=>r.stdout(`${e}\n`),signal:l.signal};return await e.login(t,n),r.stdout(`\n✓ Logged in to ${o.name}.\n`),0}catch(e){return r.stderr(`\notto auth login failed: ${e.message}\n`),1}finally{process.off(`SIGINT`,u),s?.close()}}async function o(e,t,n){if(!t)return n.stderr(`otto auth logout: missing provider. One of: ${e.listProviders().join(`, `)}\n`),1;let r=await e.hasCredential(t);return await e.logout(t),n.stdout(r?`✓ Logged out of ${t}.\n`:`${t} was not logged in.\n`),0}const s={oauth:`OAuth`,api_key:`API key (stored)`,env:`API key (env)`};async function c(e,t){await e.ensureInitialized(),t.stdout(`Authentication status:
 `);for(let n of e.listProviders()){let r=await e.getAuthSource(n),i=r?s[r]:`not configured`;t.stdout(`  ${n.padEnd(16)} ${i}\n`)}return 0}export{r as runAuthCommand};
-//# sourceMappingURL=auth-command-D1T16ed-.js.map
+//# sourceMappingURL=auth-command-BYaFM76w.js.map

package/dist/{auth-command-D1T16ed-.js.map → auth-command-BYaFM76w.js.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-command-D1T16ed-.js","names":[],"sources":["../src/auth-command.ts"],"sourcesContent":["import { createInterface } from 'node:readline/promises'\n\nimport { createHostApp } from './create-host-app'\nimport { createDefaultAuthStore } from '@x-otto/ai'\nimport type { AuthStore, OAuthLoginOptions } from '@x-otto/ai'\n\n/**\n * `otto auth login|status|logout` 子命令（M8-07）。\n *\n * 驱动 AuthStore.login 的 onAuth/onPrompt/onManualCode 回调：\n * - Anthropic（usesCallbackServer=false）→ loopback(54545) 优先自动回填，\n *   端口占用时回退托管回调 + 用户回贴 code（onManualCode 必须提供）；\n * - loopback provider（OpenAI/Codex，usesCallbackServer=true）→ 浏览器重定向自动完成。\n * - 插件 OAuth（cursor/anthropic 等）→ 须 bootstrap App 装载插件后再查 oauth 表（RFC-130 M131-1）。\n */\nexport interface AuthBootstrapOptions {\n  workspaceDir: string\n  projectConfigPath?: string\n  verbose?: boolean\n}\n\nexport interface AuthCommandDeps {\n  authStore?: AuthStore\n  /** 未注入 authStore 时，经 App.start() 装载插件 OAuth（对齐 TUI `/auth`）。 */\n  bootstrap?: AuthBootstrapOptions\n  stdout?: (s: string) => void\n  stderr?: (s: string) => void\n  /** 单行读取器（注入便于测试）；未提供时按需创建 readline。 */\n  prompt?: (question: string) => Promise<string>\n}\n\nexport async function runAuthCommand(args: string[], deps: AuthCommandDeps = {}): Promise<number> {\n  if (!deps.authStore && deps.bootstrap) {\n    const app = createHostApp({\n      workspaceDir: deps.bootstrap.workspaceDir,\n      projectConfigPath: deps.bootstrap.projectConfigPath,\n      logger: {\n        name: 'otto-auth',\n        level: deps.bootstrap.verbose ? 'debug' : 'info',\n        destination: 'stderr',\n      },\n    })\n    try {\n      await app.start()\n      return await runAuthCommand(args, {\n        ...deps,\n        authStore: app.authStore,\n        bootstrap: undefined,\n      })\n    } finally {\n      await app.stop()\n    }\n  }\n\n  const stdout = deps.stdout ?? ((s) => process.stdout.write(s))\n  const stderr = deps.stderr ?? ((s) => process.stderr.write(s))\n  // watchForExternalChanges:false —— `otto auth *` 是一次性命令，跑完即退出，不需要跨进程凭据\n  // 实时同步（那是给 TUI/serve 长驻进程用的）。AuthStore 的 fs.watch 句柄本身已 unref（不阻塞\n  // 事件循环清空，见 auth-store.ts setupWatcher 注释），此处显式关闭仍是更准确的语义表达——\n  // 避免为一个秒退的脚本无谓建立/拆除一个不会被用到的 watcher。\n  const authStore = deps.authStore ?? createDefaultAuthStore({ watchForExternalChanges: false })\n\n  const [action, provider] = args\n\n  switch (action) {\n    case 'login':\n      return authLogin(authStore, provider, { stdout, stderr, prompt: deps.prompt })\n    case 'logout':\n      return authLogout(authStore, provider, { stdout, stderr })\n    case 'status':\n    case undefined:\n      return authStatus(authStore, { stdout })\n    default:\n      stderr(`otto auth: unknown action '${action}'. Use login | status | logout.\\n`)\n      return 1\n  }\n}\n\nfunction loginableProviders(authStore: AuthStore): string[] {\n  return authStore.oauth.list().map((p) => p.id)\n}\n\nasync function authLogin(\n  authStore: AuthStore,\n  provider: string | undefined,\n  io: { stdout: (s: string) => void; stderr: (s: string) => void; prompt?: (q: string) => Promise<string> },\n): Promise<number> {\n  const providers = loginableProviders(authStore)\n  // UX（round 6）：零 provider 插件时 providers 为空数组——\"One of: \"后面是空串，\n  // 用户面对死端。指回引导路径而不是展示空名单。\n  if (providers.length === 0) {\n    io.stderr(\n      'otto auth login: no OAuth-capable providers available yet.\\n' +\n        'Install a provider plugin first — run `otto` (interactive) for guided setup,\\n' +\n        'or: otto extension install anthropic-provider\\n',\n    )\n    return 1\n  }\n  if (!provider) {\n    io.stderr(`otto auth login: missing provider. One of: ${providers.join(', ')}\\n`)\n    return 1\n  }\n\n  const oauth = authStore.oauth.get(provider)\n  if (!oauth) {\n    io.stderr(`otto auth login: unknown provider '${provider}'. One of: ${providers.join(', ')}\\n`)\n    io.stderr(\n      'Hint: plugin providers (cursor, anthropic, …) need the plugin installed with provider capability granted.\\n' +\n        '  otto extension install --link extensions/plugin-cursor --yes\\n' +\n        '  # user-scope install auto-trusts; then otto auth login cursor\\n',\n    )\n    return 1\n  }\n\n  const rl = io.prompt ? undefined : createInterface({ input: process.stdin, output: process.stdout })\n  const ask = io.prompt ?? ((q: string) => rl!.question(q))\n\n  const controller = new AbortController()\n  const onSigint = (): void => controller.abort()\n  process.on('SIGINT', onSigint)\n\n  try {\n    const options: OAuthLoginOptions = {\n      onAuth: (info) => {\n        io.stdout(`\\nOpen this URL in your browser to authorize:\\n  ${info.url}\\n`)\n        if (info.code) {\n          io.stdout(`Code: ${info.code}\\n`)\n        }\n        if (info.instructions) {\n          io.stdout(`${info.instructions}\\n`)\n        }\n      },\n      onPrompt: async (p) => {\n        const suffix = p.placeholder ? ` (${p.placeholder})` : ''\n        return (await ask(`${p.message}${suffix}: `)).trim()\n      },\n      // loopback 回调先完成时经 signal 放行。readline 本身无法中断，由 finally 的\n      // rl.close() 收尾——close 会 reject 悬挂的 question，故 catch 归一为空串防 unhandled。\n      onManualCode: async (signal?: AbortSignal) => {\n        const question = ask('\\nPaste the code here: ').then(\n          (s) => s.trim(),\n          () => '',\n        )\n        if (!signal) return question\n        if (signal.aborted) return ''\n        return Promise.race([\n          question,\n          new Promise<string>((resolve) => {\n            signal.addEventListener('abort', () => resolve(''), { once: true })\n          }),\n        ])\n      },\n      onProgress: (m) => io.stdout(`${m}\\n`),\n      signal: controller.signal,\n    }\n\n    await authStore.login(provider, options)\n    io.stdout(`\\n✓ Logged in to ${oauth.name}.\\n`)\n    return 0\n  } catch (error) {\n    io.stderr(`\\notto auth login failed: ${(error as Error).message}\\n`)\n    return 1\n  } finally {\n    process.off('SIGINT', onSigint)\n    rl?.close()\n  }\n}\n\nasync function authLogout(\n  authStore: AuthStore,\n  provider: string | undefined,\n  io: { stdout: (s: string) => void; stderr: (s: string) => void },\n): Promise<number> {\n  if (!provider) {\n    io.stderr(\n      `otto auth logout: missing provider. One of: ${authStore.listProviders().join(', ')}\\n`,\n    )\n    return 1\n  }\n\n  const had = await authStore.hasCredential(provider)\n  await authStore.logout(provider)\n  io.stdout(had ? `✓ Logged out of ${provider}.\\n` : `${provider} was not logged in.\\n`)\n  return 0\n}\n\nconst SOURCE_LABEL: Record<string, string> = {\n  oauth: 'OAuth',\n  api_key: 'API key (stored)',\n  env: 'API key (env)',\n}\n\nasync function authStatus(\n  authStore: AuthStore,\n  io: { stdout: (s: string) => void },\n): Promise<number> {\n  // RFC-341 修复：`AuthStore.listProviders()` 是同步方法，读的是内存 cache——\n  // cache 由 `ensureInitialized()`（异步读盘）填充，且没有任何调用方保证在\n  // `listProviders()` 之前完成过初始化（`getAuthSource()` 等其余方法内部各自会\n  // `await ensureInitialized()`，唯独 `listProviders()` 没有）。此前这里直接调\n  // `listProviders()` 时 cache 大概率还是空的（首次调用、无其余方法先触发过初始化\n  // 的一次性命令场景），导致 `otto auth status`/Setup Wizard 装完 provider 后\n  // 立即查询状态永远显示\"未配置\"——即便凭据其实已经成功落盘（真实事故：OrbStack\n  // 虚拟机全流程测试实测复现，auth.json 里确有凭据但 status/doctor 均报未配置）。\n  await authStore.ensureInitialized()\n  io.stdout('Authentication status:\\n')\n  for (const provider of authStore.listProviders()) {\n    const source = await authStore.getAuthSource(provider)\n    const label = source ? SOURCE_LABEL[source] : 'not configured'\n    io.stdout(`  ${provider.padEnd(16)} ${label}\\n`)\n  }\n  return 0\n}\n"],"mappings":";+JA+BA,eAAsB,EAAe,EAAgB,EAAwB,EAAE,CAAmB,CAChG,GAAI,CAAC,EAAK,WAAa,EAAK,UAAW,CACrC,IAAM,EAAM,EAAc,CACxB,aAAc,EAAK,UAAU,aAC7B,kBAAmB,EAAK,UAAU,kBAClC,OAAQ,CACN,KAAM,YACN,MAAO,EAAK,UAAU,QAAU,QAAU,OAC1C,YAAa,SACd,CACF,CAAC,CACF,GAAI,CAEF,OADA,MAAM,EAAI,OAAO,CACV,MAAM,EAAe,EAAM,CAChC,GAAG,EACH,UAAW,EAAI,UACf,UAAW,IAAA,GACZ,CAAC,QACM,CACR,MAAM,EAAI,MAAM,EAIpB,IAAM,EAAS,EAAK,SAAY,GAAM,QAAQ,OAAO,MAAM,EAAE,EACvD,EAAS,EAAK,SAAY,GAAM,QAAQ,OAAO,MAAM,EAAE,EAKvD,EAAY,EAAK,WAAa,EAAuB,CAAE,wBAAyB,GAAO,CAAC,CAExF,CAAC,EAAQ,GAAY,EAE3B,OAAQ,EAAR,CACE,IAAK,QACH,OAAO,EAAU,EAAW,EAAU,CAAE,SAAQ,SAAQ,OAAQ,EAAK,OAAQ,CAAC,CAChF,IAAK,SACH,OAAO,EAAW,EAAW,EAAU,CAAE,SAAQ,SAAQ,CAAC,CAC5D,IAAK,SACL,KAAK,IAAA,GACH,OAAO,EAAW,EAAW,CAAE,SAAQ,CAAC,CAC1C,QAEE,OADA,EAAO,8BAA8B,EAAO,mCAAmC,CACxE,GAIb,SAAS,EAAmB,EAAgC,CAC1D,OAAO,EAAU,MAAM,MAAM,CAAC,IAAK,GAAM,EAAE,GAAG,CAGhD,eAAe,EACb,EACA,EACA,EACiB,CACjB,IAAM,EAAY,EAAmB,EAAU,CAG/C,GAAI,EAAU,SAAW,EAMvB,OALA,EAAG,OACD;;;EAGD,CACM,EAET,GAAI,CAAC,EAEH,OADA,EAAG,OAAO,8CAA8C,EAAU,KAAK,KAAK,CAAC,IAAI,CAC1E,EAGT,IAAM,EAAQ,EAAU,MAAM,IAAI,EAAS,CAC3C,GAAI,CAAC,EAOH,OANA,EAAG,OAAO,sCAAsC,EAAS,aAAa,EAAU,KAAK,KAAK,CAAC,IAAI,CAC/F,EAAG,OACD;;;EAGD,CACM,EAGT,IAAM,EAAK,EAAG,OAAS,IAAA,GAAY,EAAgB,CAAE,MAAO,QAAQ,MAAO,OAAQ,QAAQ,OAAQ,CAAC,CAC9F,EAAM,EAAG,SAAY,GAAc,EAAI,SAAS,EAAE,EAElD,EAAa,IAAI,gBACjB,MAAuB,EAAW,OAAO,CAC/C,QAAQ,GAAG,SAAU,EAAS,CAE9B,GAAI,CACF,IAAM,EAA6B,CACjC,OAAS,GAAS,CAChB,EAAG,OAAO,oDAAoD,EAAK,IAAI,IAAI,CACvE,EAAK,MACP,EAAG,OAAO,SAAS,EAAK,KAAK,IAAI,CAE/B,EAAK,cACP,EAAG,OAAO,GAAG,EAAK,aAAa,IAAI,EAGvC,SAAU,KAAO,IAAM,CACrB,IAAM,EAAS,EAAE,YAAc,KAAK,EAAE,YAAY,GAAK,GACvD,OAAQ,MAAM,EAAI,GAAG,EAAE,UAAU,EAAO,IAAI,EAAE,MAAM,EAItD,aAAc,KAAO,IAAyB,CAC5C,IAAM,EAAW,EAAI;uBAA0B,CAAC,KAC7C,GAAM,EAAE,MAAM,KACT,GACP,CAGD,OAFK,EACD,EAAO,QAAgB,GACpB,QAAQ,KAAK,CAClB,EACA,IAAI,QAAiB,GAAY,CAC/B,EAAO,iBAAiB,YAAe,EAAQ,GAAG,CAAE,CAAE,KAAM,GAAM,CAAC,EACnE,CACH,CAAC,CAPkB,GAStB,WAAa,GAAM,EAAG,OAAO,GAAG,EAAE,IAAI,CACtC,OAAQ,EAAW,OACpB,CAID,OAFA,MAAM,EAAU,MAAM,EAAU,EAAQ,CACxC,EAAG,OAAO,oBAAoB,EAAM,KAAK,KAAK,CACvC,QACA,EAAO,CAEd,OADA,EAAG,OAAO,6BAA8B,EAAgB,QAAQ,IAAI,CAC7D,SACC,CACR,QAAQ,IAAI,SAAU,EAAS,CAC/B,GAAI,OAAO,EAIf,eAAe,EACb,EACA,EACA,EACiB,CACjB,GAAI,CAAC,EAIH,OAHA,EAAG,OACD,+CAA+C,EAAU,eAAe,CAAC,KAAK,KAAK,CAAC,IACrF,CACM,EAGT,IAAM,EAAM,MAAM,EAAU,cAAc,EAAS,CAGnD,OAFA,MAAM,EAAU,OAAO,EAAS,CAChC,EAAG,OAAO,EAAM,mBAAmB,EAAS,KAAO,GAAG,EAAS,uBAAuB,CAC/E,EAGT,MAAM,EAAuC,CAC3C,MAAO,QACP,QAAS,mBACT,IAAK,gBACN,CAED,eAAe,EACb,EACA,EACiB,CASjB,MAAM,EAAU,mBAAmB,CACnC,EAAG,OAAO;EAA2B,CACrC,IAAK,IAAM,KAAY,EAAU,eAAe,CAAE,CAChD,IAAM,EAAS,MAAM,EAAU,cAAc,EAAS,CAChD,EAAQ,EAAS,EAAa,GAAU,iBAC9C,EAAG,OAAO,KAAK,EAAS,OAAO,GAAG,CAAC,GAAG,EAAM,IAAI,CAElD,MAAO"}
+{"version":3,"file":"auth-command-BYaFM76w.js","names":[],"sources":["../src/auth-command.ts"],"sourcesContent":["import { createInterface } from 'node:readline/promises'\n\nimport { createHostApp } from './create-host-app'\nimport { createDefaultAuthStore } from '@x-otto/ai'\nimport type { AuthStore, OAuthLoginOptions } from '@x-otto/ai'\n\n/**\n * `otto auth login|status|logout` 子命令（M8-07）。\n *\n * 驱动 AuthStore.login 的 onAuth/onPrompt/onManualCode 回调：\n * - Anthropic（usesCallbackServer=false）→ loopback(54545) 优先自动回填，\n *   端口占用时回退托管回调 + 用户回贴 code（onManualCode 必须提供）；\n * - loopback provider（OpenAI/Codex，usesCallbackServer=true）→ 浏览器重定向自动完成。\n * - 插件 OAuth（cursor/anthropic 等）→ 须 bootstrap App 装载插件后再查 oauth 表（RFC-130 M131-1）。\n */\nexport interface AuthBootstrapOptions {\n  workspaceDir: string\n  projectConfigPath?: string\n  verbose?: boolean\n}\n\nexport interface AuthCommandDeps {\n  authStore?: AuthStore\n  /** 未注入 authStore 时，经 App.start() 装载插件 OAuth（对齐 TUI `/auth`）。 */\n  bootstrap?: AuthBootstrapOptions\n  stdout?: (s: string) => void\n  stderr?: (s: string) => void\n  /** 单行读取器（注入便于测试）；未提供时按需创建 readline。 */\n  prompt?: (question: string) => Promise<string>\n}\n\nexport async function runAuthCommand(args: string[], deps: AuthCommandDeps = {}): Promise<number> {\n  if (!deps.authStore && deps.bootstrap) {\n    const app = createHostApp({\n      workspaceDir: deps.bootstrap.workspaceDir,\n      projectConfigPath: deps.bootstrap.projectConfigPath,\n      logger: {\n        name: 'otto-auth',\n        level: deps.bootstrap.verbose ? 'debug' : 'info',\n        destination: 'stderr',\n      },\n    })\n    try {\n      await app.start()\n      return await runAuthCommand(args, {\n        ...deps,\n        authStore: app.authStore,\n        bootstrap: undefined,\n      })\n    } finally {\n      await app.stop()\n    }\n  }\n\n  const stdout = deps.stdout ?? ((s) => process.stdout.write(s))\n  const stderr = deps.stderr ?? ((s) => process.stderr.write(s))\n  // watchForExternalChanges:false —— `otto auth *` 是一次性命令，跑完即退出，不需要跨进程凭据\n  // 实时同步（那是给 TUI/serve 长驻进程用的）。AuthStore 的 fs.watch 句柄本身已 unref（不阻塞\n  // 事件循环清空，见 auth-store.ts setupWatcher 注释），此处显式关闭仍是更准确的语义表达——\n  // 避免为一个秒退的脚本无谓建立/拆除一个不会被用到的 watcher。\n  const authStore = deps.authStore ?? createDefaultAuthStore({ watchForExternalChanges: false })\n\n  const [action, provider] = args\n\n  switch (action) {\n    case 'login':\n      return authLogin(authStore, provider, { stdout, stderr, prompt: deps.prompt })\n    case 'logout':\n      return authLogout(authStore, provider, { stdout, stderr })\n    case 'status':\n    case undefined:\n      return authStatus(authStore, { stdout })\n    default:\n      stderr(`otto auth: unknown action '${action}'. Use login | status | logout.\\n`)\n      return 1\n  }\n}\n\nfunction loginableProviders(authStore: AuthStore): string[] {\n  return authStore.oauth.list().map((p) => p.id)\n}\n\nasync function authLogin(\n  authStore: AuthStore,\n  provider: string | undefined,\n  io: { stdout: (s: string) => void; stderr: (s: string) => void; prompt?: (q: string) => Promise<string> },\n): Promise<number> {\n  const providers = loginableProviders(authStore)\n  // UX（round 6）：零 provider 插件时 providers 为空数组——\"One of: \"后面是空串，\n  // 用户面对死端。指回引导路径而不是展示空名单。\n  if (providers.length === 0) {\n    io.stderr(\n      'otto auth login: no OAuth-capable providers available yet.\\n' +\n        'Install a provider plugin first — run `otto` (interactive) for guided setup,\\n' +\n        'or: otto extension install anthropic-provider\\n',\n    )\n    return 1\n  }\n  if (!provider) {\n    io.stderr(`otto auth login: missing provider. One of: ${providers.join(', ')}\\n`)\n    return 1\n  }\n\n  const oauth = authStore.oauth.get(provider)\n  if (!oauth) {\n    io.stderr(`otto auth login: unknown provider '${provider}'. One of: ${providers.join(', ')}\\n`)\n    io.stderr(\n      'Hint: plugin providers (cursor, anthropic, …) need the plugin installed with provider capability granted.\\n' +\n        '  otto extension install --link extensions/plugin-cursor --yes\\n' +\n        '  # user-scope install auto-trusts; then otto auth login cursor\\n',\n    )\n    return 1\n  }\n\n  const rl = io.prompt ? undefined : createInterface({ input: process.stdin, output: process.stdout })\n  const ask = io.prompt ?? ((q: string) => rl!.question(q))\n\n  const controller = new AbortController()\n  const onSigint = (): void => controller.abort()\n  process.on('SIGINT', onSigint)\n\n  try {\n    const options: OAuthLoginOptions = {\n      onAuth: (info) => {\n        io.stdout(`\\nOpen this URL in your browser to authorize:\\n  ${info.url}\\n`)\n        if (info.code) {\n          io.stdout(`Code: ${info.code}\\n`)\n        }\n        if (info.instructions) {\n          io.stdout(`${info.instructions}\\n`)\n        }\n      },\n      onPrompt: async (p) => {\n        const suffix = p.placeholder ? ` (${p.placeholder})` : ''\n        return (await ask(`${p.message}${suffix}: `)).trim()\n      },\n      // loopback 回调先完成时经 signal 放行。readline 本身无法中断，由 finally 的\n      // rl.close() 收尾——close 会 reject 悬挂的 question，故 catch 归一为空串防 unhandled。\n      onManualCode: async (signal?: AbortSignal) => {\n        const question = ask('\\nPaste the code here: ').then(\n          (s) => s.trim(),\n          () => '',\n        )\n        if (!signal) return question\n        if (signal.aborted) return ''\n        return Promise.race([\n          question,\n          new Promise<string>((resolve) => {\n            signal.addEventListener('abort', () => resolve(''), { once: true })\n          }),\n        ])\n      },\n      onProgress: (m) => io.stdout(`${m}\\n`),\n      signal: controller.signal,\n    }\n\n    await authStore.login(provider, options)\n    io.stdout(`\\n✓ Logged in to ${oauth.name}.\\n`)\n    return 0\n  } catch (error) {\n    io.stderr(`\\notto auth login failed: ${(error as Error).message}\\n`)\n    return 1\n  } finally {\n    process.off('SIGINT', onSigint)\n    rl?.close()\n  }\n}\n\nasync function authLogout(\n  authStore: AuthStore,\n  provider: string | undefined,\n  io: { stdout: (s: string) => void; stderr: (s: string) => void },\n): Promise<number> {\n  if (!provider) {\n    io.stderr(\n      `otto auth logout: missing provider. One of: ${authStore.listProviders().join(', ')}\\n`,\n    )\n    return 1\n  }\n\n  const had = await authStore.hasCredential(provider)\n  await authStore.logout(provider)\n  io.stdout(had ? `✓ Logged out of ${provider}.\\n` : `${provider} was not logged in.\\n`)\n  return 0\n}\n\nconst SOURCE_LABEL: Record<string, string> = {\n  oauth: 'OAuth',\n  api_key: 'API key (stored)',\n  env: 'API key (env)',\n}\n\nasync function authStatus(\n  authStore: AuthStore,\n  io: { stdout: (s: string) => void },\n): Promise<number> {\n  // RFC-341 修复：`AuthStore.listProviders()` 是同步方法，读的是内存 cache——\n  // cache 由 `ensureInitialized()`（异步读盘）填充，且没有任何调用方保证在\n  // `listProviders()` 之前完成过初始化（`getAuthSource()` 等其余方法内部各自会\n  // `await ensureInitialized()`，唯独 `listProviders()` 没有）。此前这里直接调\n  // `listProviders()` 时 cache 大概率还是空的（首次调用、无其余方法先触发过初始化\n  // 的一次性命令场景），导致 `otto auth status`/Setup Wizard 装完 provider 后\n  // 立即查询状态永远显示\"未配置\"——即便凭据其实已经成功落盘（真实事故：OrbStack\n  // 虚拟机全流程测试实测复现，auth.json 里确有凭据但 status/doctor 均报未配置）。\n  await authStore.ensureInitialized()\n  io.stdout('Authentication status:\\n')\n  for (const provider of authStore.listProviders()) {\n    const source = await authStore.getAuthSource(provider)\n    const label = source ? SOURCE_LABEL[source] : 'not configured'\n    io.stdout(`  ${provider.padEnd(16)} ${label}\\n`)\n  }\n  return 0\n}\n"],"mappings":";+JA+BA,eAAsB,EAAe,EAAgB,EAAwB,EAAE,CAAmB,CAChG,GAAI,CAAC,EAAK,WAAa,EAAK,UAAW,CACrC,IAAM,EAAM,EAAc,CACxB,aAAc,EAAK,UAAU,aAC7B,kBAAmB,EAAK,UAAU,kBAClC,OAAQ,CACN,KAAM,YACN,MAAO,EAAK,UAAU,QAAU,QAAU,OAC1C,YAAa,SACd,CACF,CAAC,CACF,GAAI,CAEF,OADA,MAAM,EAAI,OAAO,CACV,MAAM,EAAe,EAAM,CAChC,GAAG,EACH,UAAW,EAAI,UACf,UAAW,IAAA,GACZ,CAAC,QACM,CACR,MAAM,EAAI,MAAM,EAIpB,IAAM,EAAS,EAAK,SAAY,GAAM,QAAQ,OAAO,MAAM,EAAE,EACvD,EAAS,EAAK,SAAY,GAAM,QAAQ,OAAO,MAAM,EAAE,EAKvD,EAAY,EAAK,WAAa,EAAuB,CAAE,wBAAyB,GAAO,CAAC,CAExF,CAAC,EAAQ,GAAY,EAE3B,OAAQ,EAAR,CACE,IAAK,QACH,OAAO,EAAU,EAAW,EAAU,CAAE,SAAQ,SAAQ,OAAQ,EAAK,OAAQ,CAAC,CAChF,IAAK,SACH,OAAO,EAAW,EAAW,EAAU,CAAE,SAAQ,SAAQ,CAAC,CAC5D,IAAK,SACL,KAAK,IAAA,GACH,OAAO,EAAW,EAAW,CAAE,SAAQ,CAAC,CAC1C,QAEE,OADA,EAAO,8BAA8B,EAAO,mCAAmC,CACxE,GAIb,SAAS,EAAmB,EAAgC,CAC1D,OAAO,EAAU,MAAM,MAAM,CAAC,IAAK,GAAM,EAAE,GAAG,CAGhD,eAAe,EACb,EACA,EACA,EACiB,CACjB,IAAM,EAAY,EAAmB,EAAU,CAG/C,GAAI,EAAU,SAAW,EAMvB,OALA,EAAG,OACD;;;EAGD,CACM,EAET,GAAI,CAAC,EAEH,OADA,EAAG,OAAO,8CAA8C,EAAU,KAAK,KAAK,CAAC,IAAI,CAC1E,EAGT,IAAM,EAAQ,EAAU,MAAM,IAAI,EAAS,CAC3C,GAAI,CAAC,EAOH,OANA,EAAG,OAAO,sCAAsC,EAAS,aAAa,EAAU,KAAK,KAAK,CAAC,IAAI,CAC/F,EAAG,OACD;;;EAGD,CACM,EAGT,IAAM,EAAK,EAAG,OAAS,IAAA,GAAY,EAAgB,CAAE,MAAO,QAAQ,MAAO,OAAQ,QAAQ,OAAQ,CAAC,CAC9F,EAAM,EAAG,SAAY,GAAc,EAAI,SAAS,EAAE,EAElD,EAAa,IAAI,gBACjB,MAAuB,EAAW,OAAO,CAC/C,QAAQ,GAAG,SAAU,EAAS,CAE9B,GAAI,CACF,IAAM,EAA6B,CACjC,OAAS,GAAS,CAChB,EAAG,OAAO,oDAAoD,EAAK,IAAI,IAAI,CACvE,EAAK,MACP,EAAG,OAAO,SAAS,EAAK,KAAK,IAAI,CAE/B,EAAK,cACP,EAAG,OAAO,GAAG,EAAK,aAAa,IAAI,EAGvC,SAAU,KAAO,IAAM,CACrB,IAAM,EAAS,EAAE,YAAc,KAAK,EAAE,YAAY,GAAK,GACvD,OAAQ,MAAM,EAAI,GAAG,EAAE,UAAU,EAAO,IAAI,EAAE,MAAM,EAItD,aAAc,KAAO,IAAyB,CAC5C,IAAM,EAAW,EAAI;uBAA0B,CAAC,KAC7C,GAAM,EAAE,MAAM,KACT,GACP,CAGD,OAFK,EACD,EAAO,QAAgB,GACpB,QAAQ,KAAK,CAClB,EACA,IAAI,QAAiB,GAAY,CAC/B,EAAO,iBAAiB,YAAe,EAAQ,GAAG,CAAE,CAAE,KAAM,GAAM,CAAC,EACnE,CACH,CAAC,CAPkB,GAStB,WAAa,GAAM,EAAG,OAAO,GAAG,EAAE,IAAI,CACtC,OAAQ,EAAW,OACpB,CAID,OAFA,MAAM,EAAU,MAAM,EAAU,EAAQ,CACxC,EAAG,OAAO,oBAAoB,EAAM,KAAK,KAAK,CACvC,QACA,EAAO,CAEd,OADA,EAAG,OAAO,6BAA8B,EAAgB,QAAQ,IAAI,CAC7D,SACC,CACR,QAAQ,IAAI,SAAU,EAAS,CAC/B,GAAI,OAAO,EAIf,eAAe,EACb,EACA,EACA,EACiB,CACjB,GAAI,CAAC,EAIH,OAHA,EAAG,OACD,+CAA+C,EAAU,eAAe,CAAC,KAAK,KAAK,CAAC,IACrF,CACM,EAGT,IAAM,EAAM,MAAM,EAAU,cAAc,EAAS,CAGnD,OAFA,MAAM,EAAU,OAAO,EAAS,CAChC,EAAG,OAAO,EAAM,mBAAmB,EAAS,KAAO,GAAG,EAAS,uBAAuB,CAC/E,EAGT,MAAM,EAAuC,CAC3C,MAAO,QACP,QAAS,mBACT,IAAK,gBACN,CAED,eAAe,EACb,EACA,EACiB,CASjB,MAAM,EAAU,mBAAmB,CACnC,EAAG,OAAO;EAA2B,CACrC,IAAK,IAAM,KAAY,EAAU,eAAe,CAAE,CAChD,IAAM,EAAS,MAAM,EAAU,cAAc,EAAS,CAChD,EAAQ,EAAS,EAAa,GAAU,iBAC9C,EAAG,OAAO,KAAK,EAAS,OAAO,GAAG,CAAC,GAAG,EAAM,IAAI,CAElD,MAAO"}

package/dist/backend-handler-DUafuNWw.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import"zod";function e(e){return e.startsWith(`backend/`)?e.slice(8):e}function t(t,n){return{call:async(r,i)=>{let a=e(r),o=t[a];if(!o)throw Error(`${n} backend: unknown method "${a}"`);let s=o.params.safeParse(i??{});if(!s.success)throw Error(`${n} backend: invalid params for "${a}": ${JSON.stringify(s.error.issues)}`);return o.run(s.data)}}}export{t};
+//# sourceMappingURL=backend-handler-DUafuNWw.js.map

package/dist/backend-handler-DUafuNWw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-handler-DUafuNWw.js","names":[],"sources":["../src/commands/backend-handler.ts"],"sourcesContent":["import { z } from 'zod'\n\n/**\n * backend-handler.ts —— RFC-439：in-process backend methods 类型化注册表。\n *\n * 收敛 feedback-backend-methods / schedule-backend-methods 的重复样板\n * （stripBackendPrefix 复制、switch 分发、`params as unknown as X` 双重断言）：\n * 每个 backend 方法 = zod schema（参数形状 + 默认值单一真源）+ run 函数\n * （参数类型由 z.infer 推导）。面板每新增一个方法 = 表里加一条，不再复制样板。\n */\n\n/** 剥离 `backend/` 前缀（panel-backend-runtime 的 toBackendWireMethod 加的）。 */\nexport function stripBackendPrefix(method: string): string {\n  return method.startsWith('backend/') ? method.slice('backend/'.length) : method\n}\n\n/**\n * 一个 backend 方法。`params` 是参数 zod schema（默认值经 .default() 内聚，\n * 非法参数在注册表边界 fail-closed）；`run` 的执行参数类型由 schema 推导。\n */\nexport interface BackendMethod<TSchema extends z.ZodTypeAny = z.ZodTypeAny> {\n  params: TSchema\n  /**\n   * run 参数显式 `any`：`Record<string, BackendMethod>` 会用默认泛型 `ZodTypeAny`，\n   * `z.infer<ZodTypeAny>` 是 unknown——若 run 声明为 `(params: z.infer<TSchema>)`，\n   * 字面量方法（run: (params: {...}) => ...）因逆变无法赋给 `(params: unknown)`。\n   * `any` 在严格模式下允许具体签名赋给宽参数，运行期仍由 params.safeParse 把关。\n   */\n  run: (params: any) => Promise<unknown>\n}\n/**\n * 构造类型化 backend handler：统一前缀剥离 + 方法查表 + zod 参数校验 +\n * 未知方法 fail-closed（错误文案带宿主 label 便于排障）。\n */\nexport function createBackendHandler(\n  methods: Record<string, BackendMethod>,\n  label: string,\n): {\n  call: (method: string, params: Record<string, unknown>) => Promise<unknown>\n} {\n  const call = async (\n    method: string,\n    params: Record<string, unknown>,\n  ): Promise<unknown> => {\n    const name = stripBackendPrefix(method)\n    const entry = methods[name]\n    if (!entry) {\n      throw new Error(`${label} backend: unknown method \"${name}\"`)\n    }\n    const parsed = entry.params.safeParse(params ?? {})\n    if (!parsed.success) {\n      throw new Error(\n        `${label} backend: invalid params for \"${name}\": ${JSON.stringify(parsed.error.issues)}`,\n      )\n    }\n    return entry.run(parsed.data)\n  }\n  return { call }\n}\n"],"mappings":";YAYA,SAAgB,EAAmB,EAAwB,CACzD,OAAO,EAAO,WAAW,WAAW,CAAG,EAAO,MAAM,EAAkB,CAAG,EAqB3E,SAAgB,EACd,EACA,EAGA,CAkBA,MAAO,CAAE,KAjBI,MACX,EACA,IACqB,CACrB,IAAM,EAAO,EAAmB,EAAO,CACjC,EAAQ,EAAQ,GACtB,GAAI,CAAC,EACH,MAAU,MAAM,GAAG,EAAM,4BAA4B,EAAK,GAAG,CAE/D,IAAM,EAAS,EAAM,OAAO,UAAU,GAAU,EAAE,CAAC,CACnD,GAAI,CAAC,EAAO,QACV,MAAU,MACR,GAAG,EAAM,gCAAgC,EAAK,KAAK,KAAK,UAAU,EAAO,MAAM,OAAO,GACvF,CAEH,OAAO,EAAM,IAAI,EAAO,KAAK,EAEhB"}

package/dist/build-id-DjE6eVpQ.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+const e=5427,t=`9ae7b15d9`;export{e as n,t};
+//# sourceMappingURL=build-id-DjE6eVpQ.js.map

package/dist/build-id-DjE6eVpQ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-id-DjE6eVpQ.js","names":[],"sources":["../src/build-id.ts"],"sourcesContent":["// auto-generated by scripts/gen-build-id.mjs — DO NOT EDIT\nexport const BUILD_ID = 5427\nexport const BUILD_BRANCH = 'dev'\nexport const BUILD_HASH = '9ae7b15d9'\n"],"mappings":";AACA,MAAa,EAAW,KAEX,EAAa"}

package/dist/bundled-extensions/plugin-feedback/otto-plugin.json

@@ -0,0 +1,24 @@
+{
+  "id": "plugin-feedback",
+  "name": "Feedback",
+  "version": "0.1.0",
+  "description": "Feedback business contract (RFC-209): pulse survey recording (RFC-208) + GitHub issue submission (RFC-207) + dual-platform feedback panel (RFC-430). Renders no UI itself — TUI implements panels via `contributes.panels` and web-ui calls into this plugin's data/logic contract through FeedbackRegistry.",
+  "capabilities": ["feedback", "settings.read", "tui.renderer", "tui.command"],
+  "scripts": { "postinstall": "otto extension build" },
+  "contributes": {
+    "panels": [
+      {
+        "id": "feedback",
+        "title": "Feedback",
+        "entry": "panels-dist/feedback.mjs"
+      }
+    ],
+    "slashCommands": [
+      {
+        "name": "feedback",
+        "description": "Report an issue or send feedback via GitHub (/feedback [--repo <owner/repo>])",
+        "group": "other"
+      }
+    ]
+  }
+}

package/dist/bundled-extensions/plugin-feedback/panels/feedback.tsx

@@ -0,0 +1,348 @@
+/**
+ * feedback.tsx — RFC-430 M3：feedback 面板 Ink 组件。
+ *
+ * 面板走 plugin 的 `contributes.panels` 轴，由宿主 postinstall esbuild 编译为
+ * `panels-dist/feedback.mjs`。面板内数据/动作经 `usePanelBackend()` 桥接到宿主
+ * FeedbackRegistry（同 plugin-schedule 的 `usePanelBackend()` 模式）。
+ *
+ * 动作：n=新建 / m=标记已解决 / x=取消标记 / o=打开URL / r=刷新 / f=过滤 / q=关闭
+ */
+import React, { useState, useEffect, useCallback, useMemo } from 'react'
+import { Box, Text, useInput } from 'ink'
+import { GroupDivider } from '@x-otto/tui'
+import type { PanelTheme, PanelFigures } from './panel-host-globals'
+
+interface FeedbackIssueRow {
+  source: 'github' | 'coding'
+  platformIssueId: string
+  title: string
+  state: 'open' | 'closed'
+  url: string
+  author?: string
+  createdAt?: string
+  updatedAt?: string
+  kind: 'issue' | 'discussion'
+  excerpt?: string
+  labels?: string[]
+}
+
+interface FeedbackListResult {
+  items: FeedbackIssueRow[]
+  unavailable?: Partial<Record<'github' | 'coding', string>>
+}
+
+interface FeedbackResolvedMark {
+  ts: number
+  source: 'github' | 'coding'
+  platformIssueId: string
+  url: string
+  title: string
+}
+
+type View = 'list' | 'new'
+type FilterMode = 'all' | 'open' | 'resolved'
+
+declare global {
+  function getTheme(): PanelTheme
+  function getFigures(): PanelFigures
+  function usePanelFocusClaimed(): boolean
+  function requestPanelClose(): void
+  function setPanelHint(hint: string | Array<[string, string]> | undefined): void
+  function t(key: string, opts?: Record<string, unknown>): string
+  interface PanelBackendHandle<T> {
+    state: T | undefined
+    status: 'connecting' | 'ready' | 'crashed' | 'disabled'
+    call: <P extends Record<string, unknown>, R>(method: string, params: P) => Promise<R>
+  }
+  function usePanelBackend<T>(): PanelBackendHandle<T>
+}
+
+const POLL_MS = 15000
+
+const sourceBadge = (source: 'github' | 'coding', theme: PanelTheme): React.ReactElement => {
+  const label = source === 'github' ? 'GH' : 'COD'
+  const color = source === 'github' ? theme.success : theme.warning
+  return (
+    <Text key="badge" color={color} bold>
+      [{label}]
+    </Text>
+  )
+}
+
+function formatDate(iso?: string): string {
+  if (!iso) return ''
+  try {
+    return new Date(iso).toLocaleDateString()
+  } catch {
+    return iso
+  }
+}
+
+/** 行唯一 id（source + platformIssueId 组合，避免跨平台 id 碰撞）。 */
+function rowId(row: FeedbackIssueRow): string {
+  return `${row.source}:${row.platformIssueId}`
+}
+
+export default function FeedbackPanel(): React.ReactElement {
+  const backend = usePanelBackend<unknown>()
+  const [view, setView] = useState<View>('list')
+  const [selectedIndex, setSelectedIndex] = useState(0)
+  const [filterMode, setFilterMode] = useState<FilterMode>('all')
+  const [listResult, setListResult] = useState<FeedbackListResult | undefined>(undefined)
+  const [resolvedMarks, setResolvedMarks] = useState<FeedbackResolvedMark[]>([])
+  const [platform, setPlatform] = useState<'github' | 'coding'>('github')
+  const [loading, setLoading] = useState(true)
+
+  // 新建表单状态（对齐 schedule 面板 create 表单范式：formFocus + 单字符输入收集）。
+  const [formTitle, setFormTitle] = useState('')
+  const [formRepro, setFormRepro] = useState('')
+  const [formExpected, setFormExpected] = useState('')
+  const [formActual, setFormActual] = useState('')
+  const [formFocus, setFormFocus] = useState(0) // 0=title, 1=repro, 2=expected, 3=actual
+  const [formMsg, setFormMsg] = useState<string | null>(null)
+  const [formMsgTone, setFormMsgTone] = useState<'success' | 'error' | null>(null)
+  const [submitting, setSubmitting] = useState(false)
+
+  const refresh = useCallback(async () => {
+    setLoading(true)
+    try {
+      const [listResult, resolvedResult, platformResult] = await Promise.all([
+        backend.call<Record<string, unknown>, FeedbackListResult>('feedback.listIssues', { state: 'all', limitPerSource: 20 }),
+        backend.call<Record<string, unknown>, { marks: FeedbackResolvedMark[] }>('feedback.listResolvedMarks', {}),
+        backend.call<Record<string, unknown>, { platform: 'github' | 'coding' }>('feedback.resolvePlatform', {}),
+      ])
+      setListResult(listResult)
+      setResolvedMarks(resolvedResult.marks ?? [])
+      setPlatform(platformResult.platform)
+    } catch {
+      // fail-soft：面板不因单次刷新失败而崩——保持上次数据 + loading=false。
+    } finally {
+      setLoading(false)
+    }
+  }, [backend])
+
+  useEffect(() => {
+    const timer = setInterval(refresh, POLL_MS)
+    refresh()
+    return () => clearInterval(timer)
+  }, [refresh])
+
+  const allRows = useMemo<FeedbackIssueRow[]>(() => listResult?.items ?? [], [listResult])
+
+  const resolvedSet = useMemo(() => {
+    const s = new Set<string>()
+    for (const m of resolvedMarks) s.add(`${m.source}:${m.platformIssueId}`)
+    return s
+  }, [resolvedMarks])
+
+  const filteredRows = useMemo(() => {
+    return allRows.filter((row) => {
+      const isResolved = resolvedSet.has(rowId(row))
+      if (filterMode === 'resolved') return isResolved
+      if (filterMode === 'open') return !isResolved
+      return true
+    })
+  }, [allRows, resolvedSet, filterMode])
+
+  useEffect(() => {
+    setSelectedIndex((i) => (filteredRows.length === 0 ? 0 : Math.min(i, filteredRows.length - 1)))
+  }, [filteredRows])
+
+  const markResolved = useCallback(async (row: FeedbackIssueRow) => {
+    await backend.call('feedback.markResolved', {
+      source: row.source,
+      platformIssueId: row.platformIssueId,
+      url: row.url,
+      title: row.title,
+    })
+    refresh()
+  }, [backend, refresh])
+
+  const unmarkResolved = useCallback(async (row: FeedbackIssueRow) => {
+    await backend.call('feedback.unmarkResolved', {
+      source: row.source,
+      platformIssueId: row.platformIssueId,
+    })
+    refresh()
+  }, [backend, refresh])
+
+  const submitForm = useCallback(async () => {
+    if (submitting) return
+    if (!formTitle.trim()) {
+      setFormMsg(t('feedbackPanel.formRequired'))
+      return
+    }
+    setSubmitting(true)
+    setFormMsg(t('feedbackPanel.formSubmitting'))
+    setFormMsgTone(null)
+    try {
+      const resp = await backend.call<
+        Record<string, unknown>,
+        { ok: boolean; url?: string; error?: string }
+      >('feedback.submitIssue', {
+        title: formTitle,
+        reproduce: formRepro || undefined,
+        expected: formExpected || undefined,
+        actual: formActual || undefined,
+      })
+      if (resp?.ok && resp.url) {
+        setFormMsg(t('feedbackPanel.formSuccess', { url: resp.url }))
+        setFormMsgTone('success')
+        setView('list')
+      } else if (resp?.error === 'repo-unresolved') {
+        setFormMsg(t('feedbackPanel.formRepoUnresolved'))
+        setFormMsgTone('error')
+      } else {
+        setFormMsg(t('feedbackPanel.formNoChannel'))
+        setFormMsgTone('error')
+      }
+    } catch {
+      setFormMsg(t('feedbackPanel.formNoChannel'))
+      setFormMsgTone('error')
+    } finally {
+      setSubmitting(false)
+    }
+  }, [backend, formTitle, formRepro, formExpected, formActual, submitting])
+
+  useInput((input, key) => {
+    if (view === 'new') {
+      if (key.escape || input === 'q') {
+        setView('list')
+        setFormMsg(null)
+        return
+      }
+      if (key.tab) {
+        setFormFocus((f) => (f + 1) % 4)
+        return
+      }
+      if (key.return) {
+        void submitForm()
+        return
+      }
+      if (key.backspace || key.delete) {
+        if (formFocus === 0) setFormTitle((v) => v.slice(0, -1))
+        else if (formFocus === 1) setFormRepro((v) => v.slice(0, -1))
+        else if (formFocus === 2) setFormExpected((v) => v.slice(0, -1))
+        else if (formFocus === 3) setFormActual((v) => v.slice(0, -1))
+        return
+      }
+      if (input && input.length === 1) {
+        if (formFocus === 0) setFormTitle((v) => v + input)
+        else if (formFocus === 1) setFormRepro((v) => v + input)
+        else if (formFocus === 2) setFormExpected((v) => v + input)
+        else if (formFocus === 3) setFormActual((v) => v + input)
+      }
+      return
+    }
+    if (key.downArrow || input === 'j') {
+      setSelectedIndex((i) => (filteredRows.length === 0 ? 0 : Math.min(i + 1, filteredRows.length - 1)))
+    }
+    if (key.upArrow || input === 'k') {
+      setSelectedIndex((i) => Math.max(i - 1, 0))
+    }
+    if (input === 'n') setView('new')
+    if (input === 'r') refresh()
+    if (input === 'f') setFilterMode((v) => (v === 'all' ? 'open' : v === 'open' ? 'resolved' : 'all'))
+    if (input === 'm' && filteredRows[selectedIndex]) {
+      const row = filteredRows[selectedIndex]
+      const isResolved = resolvedSet.has(rowId(row))
+      if (isResolved) unmarkResolved(row)
+      else markResolved(row)
+    }
+    if (input === 'x' && filteredRows[selectedIndex]) {
+      unmarkResolved(filteredRows[selectedIndex])
+    }
+    if (input === 'o' && filteredRows[selectedIndex]) {
+      // 打开 URL——面板进程内不可直接 spawn 浏览器，经宿主侧 backend 的
+      // feedback.openExternal（openBrowser）打开（RFC-430 D4）。
+      void backend.call('feedback.openExternal', { url: filteredRows[selectedIndex].url })
+    }
+    if (input === 'q' || key.escape) requestPanelClose()
+  })
+
+  const theme = getTheme()
+  const figures = getFigures()
+
+  useEffect(() => {
+    setPanelHint([
+      ['n', t('feedbackPanel.hintNew')],
+      ['m', t('feedbackPanel.hintMark')],
+      ['x', t('feedbackPanel.hintUnmark')],
+      ['o', t('feedbackPanel.hintOpen')],
+      ['r', t('feedbackPanel.hintRefresh')],
+      ['f', t('feedbackPanel.hintFilter')],
+      ['q', t('feedbackPanel.hintClose')],
+    ])
+  }, [])
+
+  const formRow = (label: string, value: string, focused: boolean, placeholder: string) => (
+    <Box flexDirection="row" gap={1}>
+      <Text dimColor={!focused}>{focused ? figures.pointer : ' '} {label}</Text>
+      <Text dimColor={!value && !focused}>{value || placeholder}</Text>
+      <Text color={theme.selection}>{value || (focused ? '_' : '')}</Text>
+    </Box>
+  )
+
+  if (view === 'new') {
+    return (
+      <Box flexDirection="column" gap={1}>
+        <Text bold>{t('feedbackPanel.newTitle')}</Text>
+        <Text dimColor>{t('feedbackPanel.newSubtitle', { platform })}</Text>
+        {formRow(t('feedbackPanel.formTitle'), formTitle, formFocus === 0, '')}
+        {formRow(t('feedbackPanel.formRepro'), formRepro, formFocus === 1, t('feedbackPanel.formRepro'))}
+        {formRow(t('feedbackPanel.formExpected'), formExpected, formFocus === 2, t('feedbackPanel.formExpected'))}
+        {formRow(t('feedbackPanel.formActual'), formActual, formFocus === 3, t('feedbackPanel.formActual'))}
+        {formMsg && (
+          <Text color={formMsgTone === 'success' ? theme.success : theme.warning}>
+            {formMsg}
+          </Text>
+        )}
+        <Text dimColor>{t('feedbackPanel.formHint')}</Text>
+      </Box>
+    )
+  }
+
+  return (
+    <Box flexDirection="column" gap={1}>
+      <Box justifyContent="space-between">
+        <Text bold>{t('feedbackPanel.title')}</Text>
+        <Text dimColor>{t('feedbackPanel.platform', { platform })}</Text>
+      </Box>
+      {loading && <Text dimColor>{t('feedbackPanel.loading')}</Text>}
+      {listResult?.unavailable &&
+        Object.entries(listResult.unavailable).map(([source, reason]) => (
+          <Box key={source}>
+            <Text color={theme.warning}>
+              {source}: {reason}
+            </Text>
+          </Box>
+        ))}
+      <Box flexDirection="column">
+        {filteredRows.length === 0 && !loading && (
+          <Text dimColor>{t('feedbackPanel.empty')}</Text>
+        )}
+        {filteredRows.map((row, i) => {
+          const isSelected = i === selectedIndex
+          const isResolved = resolvedSet.has(rowId(row))
+          return (
+            <Box key={rowId(row)} gap={1}>
+              {isSelected && <Text color={theme.selection}>{figures.pointer}</Text>}
+              {sourceBadge(row.source, theme)}
+              <Text dimColor={isResolved}>
+                {isResolved ? `${figures.check} ` : ''}{row.title}
+              </Text>
+              <Text dimColor>{formatDate(row.updatedAt ?? row.createdAt)}</Text>
+              <Text dimColor>{row.state}</Text>
+            </Box>
+          )
+        })}
+      </Box>
+      <GroupDivider label={t('feedbackPanel.legend')} />
+      <Box gap={2}>
+        <Text dimColor>{t('feedbackPanel.filter', { filter: filterMode })}</Text>
+        <Text dimColor>{t('feedbackPanel.total', { count: String(filteredRows.length) })}</Text>
+      </Box>
+      <Text dimColor>{t('feedbackPanel.resolvedNote')}</Text>
+    </Box>
+  )
+}

package/dist/bundled-extensions/plugin-feedback/panels/panel-host-globals.d.ts

@@ -0,0 +1,67 @@
+/**
+ * panel-host-globals.d.ts — 插件面板宿主桥接全局类型声明（RFC-353 S12）。
+ *
+ * `panel-compiler.ts` 用 esbuild banner 把宿主运行时（`getTheme`/`getFigures`/
+ * `usePanelBackend`/`usePanelFocusClaimed`/`requestPanelClose`/`setPanelHint`/`t`）
+ * 注入为面板产物的全局引用（非常规 import，见 `packages/coding/src/plugin/panel-compiler.ts`
+ * 头注释）。此前每个面板 `.tsx` 文件各自手写一份 `declare function ...`（逐文件重复），
+ * 是漂移风险源——2026-08-11 review 实测发现 schedule.tsx 三处 `backend.call<TResult>()`
+ * 调用漏传 `TParams` 泛型参数（`call<TParams, TResult>` 签名下单参数会被错误绑定到
+ * `TParams`），typecheck 覆盖打开后才暴露（本文件与该修复同批落地）。
+ *
+ * 本文件用 `declare global` 环境声明（ambient declaration）替代逐文件重复：TS 编译器
+ * 按 tsconfig `include` 把本文件纳入同一程序，`declare global` 块内的声明对整个程序
+ * 全局可见，面板 `.tsx` 文件无需 import 即可直接使用这些函数名（与
+ * `packages/coding/src/global.d.ts` 声明 `globalThis.React` 同一模式）。
+ *
+ * 本文件是纯类型声明（zero JS 产出），且从不被任何 `.tsx` 文件 import——不会被
+ * esbuild 打包，只参与 tsc 类型检查程序。
+ */
+export interface PanelTheme {
+  text: string | undefined
+  inactive: string
+  secondary: string
+  success: string
+  error: string
+  warning: string
+  special: string
+  selection: string
+  focusBorder: string
+  panelBorder: string
+}
+
+export interface PanelFigures {
+  check: string
+  cross: string
+  pointer: string
+  bullet: string
+}
+
+export type PanelBackendStatus = 'connecting' | 'ready' | 'crashed' | 'disabled'
+
+export interface PanelBackendHandle<TState = unknown> {
+  /**
+   * `TParams` 必须显式指定（或从传入的 `params` 字面量推断）——本函数签名是
+   * `<TParams, TResult>`（不是 `<TResult>`）。调用方若只想指定返回类型，须写
+   * `call<Record<string, unknown>, TResult>(...)` 或让 TS 从 params 参数推断 TParams，
+   * 不能省略只传一个类型参数（会被错误绑定到 TParams 而非 TResult）。
+   */
+  call: <TParams extends Record<string, unknown>, TResult = unknown>(
+    method: string,
+    params: TParams,
+    opts?: { operationId?: string },
+  ) => Promise<TResult>
+  cancel: (operationId: string) => void
+  state: TState | undefined
+  status: PanelBackendStatus
+}
+
+declare global {
+  function getTheme(): PanelTheme
+  function getFigures(): PanelFigures
+  function usePanelFocusClaimed(): boolean
+  function requestPanelClose(): void
+  function setPanelHint(hint: string | Array<[string, string]> | undefined): void
+  function t(key: string, opts?: Record<string, unknown>): string
+  function usePanelBackend<TState = unknown>(): PanelBackendHandle<TState>
+}