agentic-flow-kit 1.8.7 → 2.0.0

package/templates/hosts/pi/extensions/lib/gates-core.cjs

@@ -0,0 +1,196 @@
+#!/usr/bin/env node
+'use strict';
+/**
+ * PI 宿主 → 仓库既有 .cjs 门禁的协议适配层（本机私有，.pi/ 已 gitignore）。
+ * 单源纪律：判据仍只养在 .agents/hooks/*.cjs；本文件只做字段映射、进程调用与结果解析。
+ * 可运行自检：node .pi/extensions/lib/gates-core.cjs
+ */
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const TIMEOUT_MS = 30000;
+
+// 代码执行类工具的门禁视图：pre-shell-check.cjs:49 只认 bash/shell 家族工具名，
+// 故在适配层把新工具规范化为 bash 并交出其命令文本；判据仍单源在 .agents/hooks/。
+const GATE_TOOL_ALIAS = { ctx_execute: 'bash', ctx_batch: 'bash' };
+
+function toShellCommand(toolName, input) {
+  const i = input && typeof input === 'object' ? input : {};
+  if (toolName === 'bash') return typeof i.command === 'string' ? i.command : '';
+  if (toolName === 'ctx_execute') return typeof i.code === 'string' ? i.code : '';
+  if (toolName === 'ctx_batch') {
+    return Array.isArray(i.commands) ? i.commands.filter((c) => typeof c === 'string').join('\n') : '';
+  }
+  return '';
+}
+
+// PI 工具入参 → 门禁脚本所需的 PreToolUse/PostToolUse stdin payload
+function toHookPayload(toolName, input, cwd, hookEventName) {
+  const i = input && typeof input === 'object' ? input : {};
+  const gateTool = GATE_TOOL_ALIAS[toolName] || toolName;
+  const payload = {
+    session_id: 'pi-host',
+    transcript_path: '',
+    cwd,
+    permission_mode: 'default',
+    hook_event_name: hookEventName || 'PreToolUse',
+    tool_name: gateTool,
+    llm_tool_name: gateTool,
+    workspace_roots: [cwd],
+    tool_input: {},
+  };
+  if (toolName === 'bash' || GATE_TOOL_ALIAS[toolName]) {
+    payload.tool_input = { command: toShellCommand(toolName, i) };
+  } else if (toolName === 'write') {
+    payload.tool_input = { file_path: i.path, content: i.content };
+  } else if (toolName === 'edit') {
+    payload.tool_input = {
+      file_path: i.path,
+      edits: Array.isArray(i.edits)
+        ? i.edits.map((e) => ({ old_string: e && e.oldText, new_string: e && e.newText }))
+        : [],
+    };
+  }
+  return payload;
+}
+
+// 门脚本 stdout 是单行 JSON；无输出 = 放行。跳过日志行，取最后一个判定对象。
+function parseGateOutput(stdout) {
+  const text = String(stdout || '').trim();
+  if (!text) return null;
+  for (const line of text.split(/\r?\n/).reverse()) {
+    const s = line.trim();
+    if (!s || s[0] !== '{') continue;
+    try {
+      const h = JSON.parse(s).hookSpecificOutput;
+      if (!h || typeof h !== 'object') continue;
+      return {
+        decision: String(h.permissionDecision || ''),
+        reason: String(h.permissionDecisionReason || ''),
+        context: String(h.additionalContext || ''),
+      };
+    } catch { /* 非判定行 */ }
+  }
+  return null;
+}
+
+function runGate(scriptName, payload, cwd) {
+  const script = path.join(cwd, '.agents', 'hooks', scriptName);
+  const r = spawnSync(process.execPath, [script], {
+    cwd,
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    timeout: TIMEOUT_MS,
+    windowsHide: true,
+  });
+  return {
+    failed: Boolean(r.error) || r.status !== 0,
+    failure: r.error ? String(r.error.message || r.error) : String((r.stderr || '').trim()),
+    status: r.status,
+    output: parseGateOutput(r.stdout),
+  };
+}
+
+// ── L1 自保护：.pi/ 接线区（本机私有、git 不可见）────────
+// 接线完整性基线：两个接线文件 + 两个门脚本，缺一即告警。
+// （PostToolUse 反馈腿 post-edit-check.cjs 已于 2026-11-08 档 1 减重退役，不再计入。）
+const REQUIRED_FILES = [
+  '.pi/extensions/shipyard-gates.ts',
+  '.pi/extensions/lib/gates-core.cjs',
+  '.agents/hooks/pre-shell-check.cjs',
+  '.agents/hooks/pre-write-check.cjs',
+];
+
+function normalizeRel(target, cwd) {
+  if (typeof target !== 'string' || !target) return '';
+  const abs = path.isAbsolute(target) ? path.resolve(target) : path.resolve(cwd, target);
+  return path.relative(cwd, abs).replace(/\\/g, '/');
+}
+
+function isProtectedPiPath(target, cwd) {
+  const rel = normalizeRel(target, cwd);
+  return rel === '.pi' || rel.startsWith('.pi/');
+}
+
+// bash 通道：须同时命中 .pi 路径引用 + 写入语义，避免拦掉只读执行。
+// 重定向单独判：不能用裸 `>`（JS 箭头函数 `=>` 会造成大面积误伤）。
+const PI_REF_RE = /(?:^|[^A-Za-z0-9_])\.pi[\\/]/i;
+const WRITE_VERB_RE = /\b(?:rm|del|erase|rmdir|rd|mv|move|rename|ren|unlink|cp|copy|tee|touch|mkdir|md|sed\s+-i|set-content|add-content|out-file|new-item|writeFileSync|writeFile|createWriteStream|appendFileSync|unlinkSync|rmSync|renameSync)\b/i;
+const REDIRECT_RE = /(?:^|[^=])>{1,2}\s*(?:[^\s]*[\\/])?\.pi[\\/]/i;
+
+function isPiWriteCommand(command) {
+  if (typeof command !== 'string' || !command) return false;
+  if (!PI_REF_RE.test(command)) return false;
+  return WRITE_VERB_RE.test(command) || REDIRECT_RE.test(command);
+}
+
+function checkWiring(cwd) {
+  const missing = REQUIRED_FILES.filter((f) => !fs.existsSync(path.join(cwd, f)));
+  return { ok: missing.length === 0, missing };
+}
+
+module.exports = { toHookPayload, toShellCommand, parseGateOutput, runGate, isProtectedPiPath, isPiWriteCommand, checkWiring };
+
+// ── assert 驱动自检（require.main 时才会跑；被 PI 加载时不执行）──
+if (require.main === module) {
+  const cwd = path.resolve(__dirname, '..', '..', '..');
+  const cases = [];
+  const check = (name, ok) => cases.push([name, Boolean(ok)]);
+
+  const bash = toHookPayload('bash', { command: 'node -v' }, cwd);
+  check('bash → command / tool_name / cwd', bash.tool_input.command === 'node -v' && bash.tool_name === 'bash' && bash.cwd === cwd);
+  const write = toHookPayload('write', { path: 'backend/A.cs', content: 'x' }, cwd);
+  check('write → file_path / content', write.tool_input.file_path === 'backend/A.cs' && write.tool_input.content === 'x');
+  const edit = toHookPayload('edit', { path: 'backend/A.cs', edits: [{ oldText: 'a', newText: 'b' }] }, cwd);
+  check('edit → oldText/newText 转 old_string/new_string',
+    edit.tool_input.file_path === 'backend/A.cs' && edit.tool_input.edits[0].old_string === 'a' && edit.tool_input.edits[0].new_string === 'b');
+
+  const exec = toHookPayload('ctx_execute', { code: 'console.log(1)' }, cwd);
+  check('ctx_execute → 规范化 tool_name + code 转 command',
+    exec.tool_name === 'bash' && exec.llm_tool_name === 'bash' && exec.tool_input.command === 'console.log(1)');
+  const batch = toHookPayload('ctx_batch', { commands: ['git status', 'node -v'] }, cwd);
+  check('ctx_batch → commands 拼接为 command',
+    batch.tool_name === 'bash' && batch.tool_input.command === 'git status\nnode -v');
+  const execDenied = runGate('pre-shell-check.cjs', toHookPayload('ctx_execute', { code: 'git reset --hard' }, cwd), cwd);
+  check('ctx_execute 代码含红线命令 → deny', !execDenied.failed && execDenied.output && execDenied.output.decision === 'deny');
+  const batchNoVerify = runGate('pre-shell-check.cjs', toHookPayload('ctx_batch', { commands: ['git commit --no-verify -m x'] }, cwd), cwd);
+  check('ctx_batch 命令含 --no-verify → deny', !batchNoVerify.failed && batchNoVerify.output && batchNoVerify.output.decision === 'deny');
+  const execAllowed = runGate('pre-shell-check.cjs', exec, cwd);
+  check('ctx_execute 普通代码放行', !execAllowed.failed && execAllowed.output === null);
+  check('代码执行类工具的 .pi/ 写入可被自保护识别',
+    isPiWriteCommand(toShellCommand('ctx_execute', { code: "fs.writeFileSync('.pi/x','y')" })) &&
+    isPiWriteCommand(toShellCommand('ctx_batch', { commands: ['rm -rf .pi/extensions'] })));
+
+  const parsed = parseGateOutput(JSON.stringify({
+    hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: 'R' },
+  }));
+  check('解析 deny 判定', parsed && parsed.decision === 'deny' && parsed.reason === 'R');
+  check('无输出视为放行', parseGateOutput('') === null);
+
+  const denied = runGate('pre-shell-check.cjs', toHookPayload('bash', { command: 'git reset --hard' }, cwd), cwd);
+  check('pre-shell-check 对 git reset --hard 判 deny', !denied.failed && denied.output && denied.output.decision === 'deny');
+  const asked = runGate('pre-shell-check.cjs', toHookPayload('bash', { command: 'git checkout main' }, cwd), cwd);
+  check('pre-shell-check 对 git checkout 判 ask', !asked.failed && asked.output && asked.output.decision === 'ask');
+  const allowed = runGate('pre-shell-check.cjs', toHookPayload('bash', { command: 'node -v' }, cwd), cwd);
+  check('pre-shell-check 对普通命令放行', !allowed.failed && allowed.output === null);
+  const writeAllowed = runGate('pre-write-check.cjs', toHookPayload('write', { path: '.pi/x.txt', content: 'x' }, cwd), cwd);
+  check('pre-write-check 对非受保护文件放行', !writeAllowed.failed && writeAllowed.output === null);
+
+  check('受保护路径：.pi/ 内文件', isProtectedPiPath('.pi/settings.json', cwd) && isProtectedPiPath('.pi/extensions/shipyard-gates.ts', cwd));
+  check('受保护路径：绝对路径同样命中', isProtectedPiPath(path.join(cwd, '.pi', 'x'), cwd));
+  check('非受保护路径：业务文件 / .pi-other', !isProtectedPiPath('backend/A.cs', cwd) && !isProtectedPiPath('.pi-other/x', cwd));
+  check('bash：删除 .pi/ 判为写入', isPiWriteCommand('rm -rf .pi/extensions'));
+  check('bash：node 写文件判为写入', isPiWriteCommand('node -e "fs.writeFileSync(\'.pi/x\',\'y\')"'));
+  check('bash：只读执行 .pi/ 不拦', !isPiWriteCommand('node .pi/extensions/lib/gates-core.cjs'));
+  check('bash：JS 箭头函数不误判为写入', !isPiWriteCommand('node -e "const f = () => 1" .pi/x'));
+  check('bash：重定向写入 .pi/ 判为写入', isPiWriteCommand('echo x > .pi/y'));
+  check('bash：无关命令不拦', !isPiWriteCommand('git status'));
+  check('接线完整性：当前仓库齐备', checkWiring(cwd).ok);
+  check('接线完整性：空目录报缺 4 项', checkWiring(path.join(cwd, '__no_such_repo__')).missing.length === 4);
+
+  for (const [name, ok] of cases) console.log(`${ok ? 'PASS' : 'FAIL'}  ${name}`);
+  const failed = cases.filter(([, ok]) => !ok).length;
+  console.log(`\n${cases.length - failed}/${cases.length} passed`);
+  if (failed) process.exit(1);
+}

package/templates/hosts/pi/extensions/shipyard-gates.ts

@@ -0,0 +1,95 @@
+/**
+ * PI 宿主接线（本机私有，.pi/ 已 gitignore）。
+ * 把 PI 的 tool_call 桥到仓库既有的 .agents/hooks/*.cjs 门禁；
+ * 判据单源仍在 .agents/hooks/，本文件不复制任何规则。
+ *
+ * 覆盖：
+ *   bash / ctx_execute / ctx_batch → pre-shell-check.cjs
+ *   write / edit → pre-write-check.cjs
+ * 另含 L1 自保护：.pi/ 接线区写入须人工确认 + 会话启动接线完整性自检。
+ */
+// /reload 只重编译 TS 扩展，CJS 依赖会留在 require 缓存里：旧 core 缺新导出会让每次
+// tool_call 抛 TypeError。加载时按 cwd 强制重读磁盘副本，保证 core 与 TS 同步。
+import { createRequire } from "node:module";
+import path from "node:path";
+
+const req = createRequire(path.join(process.cwd(), "pi-host-noop.js"));
+const corePath = path.join(process.cwd(), ".pi", "extensions", "lib", "gates-core.cjs");
+delete req.cache[req.resolve(corePath)];
+const core = req(corePath);
+
+const PRE_GATES: Record<string, string> = {
+  bash: "pre-shell-check.cjs",
+  // 代码执行类工具：core.toHookPayload 会把工具名规范化为门禁可识别的 bash 视图，
+  // 并交出 code / commands 作为命令文本，避免形成命令门绕过口。
+  ctx_execute: "pre-shell-check.cjs",
+  ctx_batch: "pre-shell-check.cjs",
+  write: "pre-write-check.cjs",
+  edit: "pre-write-check.cjs",
+};
+// 会话内解锁：人工确认一次后 5 分钟内不再重复询问（纯内存态，PI 的文件工具改不到）。
+const SELF_UNLOCK_MS = 5 * 60 * 1000;
+let selfUnlockUntil = 0;
+
+export default function (pi: any) {
+  pi.on("session_start", async (_event: any, ctx: any) => {
+    const cwd: string = ctx.cwd || process.cwd();
+    const state = core.checkWiring(cwd);
+    if (state.ok) return;
+    const msg = `PI 门禁接线不完整，缺失：${state.missing.join("、")}。写前门/命令门可能未生效，请检查 .pi/extensions 与 .agents/hooks。`;
+    if (ctx.hasUI) ctx.ui.notify(msg, "error");
+    console.error(`[shipyard-gates] ${msg}`);
+  });
+
+  pi.on("tool_call", async (event: any, ctx: any) => {
+    const tool = String(event.toolName || "");
+    const cwd: string = ctx.cwd || process.cwd();
+    const input = event.input || {};
+
+    // L1 自保护：.pi/ 接线区不入库、git 侧不可见，任何写入须人工确认。
+    // 代码执行类工具同样能写 .pi/，按 core 提取出的命令文本判写入语义。
+    const isShellTool = PRE_GATES[tool] === "pre-shell-check.cjs";
+    const touchesPi =
+      ((tool === "write" || tool === "edit") && core.isProtectedPiPath(input.path, cwd)) ||
+      (isShellTool && core.isPiWriteCommand(core.toShellCommand(tool, input)));
+    if (touchesPi && Date.now() >= selfUnlockUntil) {
+      const where = String(isShellTool ? core.toShellCommand(tool, input) : input.path || "").slice(0, 160);
+      const reason = `本次调用会改写 .pi/ 接线区（不入库、git 不可见，改后门禁可能失效）：${tool} → ${where}`;
+      if (!ctx.hasUI) return { block: true, reason };
+      const ok = await ctx.ui.confirm("PI 接线区写入需确认", reason);
+      if (!ok) return { block: true, reason };
+      selfUnlockUntil = Date.now() + SELF_UNLOCK_MS;
+    }
+
+    const script = PRE_GATES[tool];
+    if (!script) return;
+
+    const result = core.runGate(
+      script,
+      core.toHookPayload(tool, event.input, cwd, "PreToolUse"),
+      cwd,
+    );
+
+    // 门禁脚本不可用时不放行：静默绕过比阻断更危险。
+    if (result.failed) {
+      return {
+        block: true,
+        reason: `门禁脚本未成功执行（${script}）：${result.failure || `exit ${result.status}`}。为避免静默绕过，本次调用已阻止。`,
+      };
+    }
+
+    const out = result.output;
+    if (!out) return;
+    if (out.decision === "deny") return { block: true, reason: out.reason || "门禁拒绝" };
+    if (out.decision === "ask") {
+      const reason = out.reason || "命令门禁要求人工确认";
+      if (ctx.hasUI) {
+        const ok = await ctx.ui.confirm("命令门禁需确认", reason);
+        if (!ok) return { block: true, reason };
+        return;
+      }
+      return { block: true, reason: `需人工确认（当前模式无交互 UI）：${reason}` };
+    }
+  });
+
+}

package/templates/hosts/pi/settings.json

@@ -0,0 +1,5 @@
+{
+  "subagents": {
+    "agentExcludeDirs": ["../.agents/pipelines"]
+  }
+}

package/templates/hosts/qoder/agents/implementer.md

@@ -0,0 +1,9 @@
+---
+name: implementer
+description: Implements an approved, tightly scoped code change or test when the task includes owned files and executable acceptance criteria
+tools: Read, Write, Edit, Glob, Grep, Bash
+---
+
+# Implementer
+
+公共角色契约：`.agents/roles/implementer.md`。本文件只保留宿主 frontmatter。

package/templates/hosts/qoder/agents/independent-reviewer.md

@@ -0,0 +1,10 @@
+---
+name: independent-reviewer
+description: Independently reviews a fixed spec, plan, or code diff for correctness and project-rule violations without modifying files
+tools: Read, Glob, Grep
+disallowedTools: Write, Edit, Bash, NotebookEdit
+---
+
+# Independent Reviewer
+
+公共角色契约：`.agents/roles/independent-reviewer.md`。本文件只保留宿主 frontmatter。

package/templates/hosts/qoder/agents/pr-adjudicator.md

@@ -0,0 +1,10 @@
+---
+name: pr-adjudicator
+description: PR 面板评审的只读裁决者；处理 escalated 候选并返回裁决
+tools: Read, Glob, Grep
+disallowedTools: Write, Edit, Bash, NotebookEdit
+---
+
+# PR Adjudicator
+
+公共角色契约：`.agents/roles/pr-adjudicator.md`。本文件只保留宿主 frontmatter。

package/templates/hosts/qoder/agents/pr-finder.md

@@ -0,0 +1,10 @@
+---
+name: pr-finder
+description: PR 面板评审的只读 finder；按镜头独立找 bug，返回候选 JSON
+tools: Read, Glob, Grep
+disallowedTools: Write, Edit, Bash, NotebookEdit
+---
+
+# PR Finder
+
+公共角色契约：`.agents/roles/pr-finder.md`。本文件只保留宿主 frontmatter。

package/templates/hosts/qoder/agents/pr-verifier.md

@@ -0,0 +1,10 @@
+---
+name: pr-verifier
+description: PR 面板评审的只读 verifier；独立验证单条候选并返回票 JSON
+tools: Read, Glob, Grep
+disallowedTools: Write, Edit, Bash, NotebookEdit
+---
+
+# PR Verifier
+
+公共角色契约：`.agents/roles/pr-verifier.md`。本文件只保留宿主 frontmatter。

package/templates/hosts/qoder/agents/ui-verifier.md

@@ -0,0 +1,10 @@
+---
+name: ui-verifier
+description: Runs browser-based verification for an implemented UI change and returns reproducible evidence without editing repository files
+tools: Read, Glob, Grep, Bash, mcp__chrome_devtools__*
+disallowedTools: Write, Edit, NotebookEdit
+---
+
+# UI Verifier
+
+公共角色契约：`.agents/roles/ui-verifier.md`。本文件只保留宿主 frontmatter。

package/templates/hosts/qoder/agents/wiki-compiler.md

@@ -0,0 +1,10 @@
+---
+name: wiki-compiler
+description: Translates a code commit into strict JSON describing what business capability the system gained, written for non-coding readers (product/customer service); read-only analysis, never edits files
+tools: Read, Glob, Grep, Bash
+disallowedTools: Write, Edit, NotebookEdit
+---
+
+# Wiki Compiler
+
+公共角色契约：`.agents/roles/wiki-compiler.md`。本文件只保留宿主 frontmatter。

package/templates/hosts/qoder/commands/wf-deploy.md

@@ -0,0 +1,8 @@
+---
+name: wf-deploy
+description: Deploy 阶段:合入清单(静态门 + 配对检查 + 回归 + DB + 授权 + PR 审查合并)
+---
+
+权威命令：`.agents/commands/deploy.md`
+
+本文件是指针壳。执行时读取权威源，不在此复制正文。

package/templates/hosts/qoder/commands/wf-maintain.md

@@ -0,0 +1,8 @@
+---
+name: wf-maintain
+description: Maintain 阶段:立 incident + 复盘三件套(修复 / 防复发 / 规范条目)
+---
+
+权威命令：`.agents/commands/maintain.md`
+
+本文件是指针壳。执行时读取权威源，不在此复制正文。

package/templates/hosts/qoder/commands/wf-new-task.md

@@ -0,0 +1,8 @@
+---
+name: wf-new-task
+description: AI-Native 闭环总入口:6 阶段指令索引(Plan→Design→Build→Test→Deploy→Maintain)
+---
+
+权威命令：`.agents/commands/new-task.md`
+
+本文件是指针壳。执行时读取权威源，不在此复制正文。

package/templates/hosts/qoder/commands/wf-pipeline-run.md

@@ -0,0 +1,8 @@
+---
+name: wf-pipeline-run
+description: pipeline-run 自动化驱动入口——单命令驱动六阶段闭环（工单协议+机器门+原话代录）；与手动阶段路由二选一，禁混用
+---
+
+权威命令：`.agents/commands/pipeline-run.md`
+
+本文件是指针壳。执行时读取权威源，不在此复制正文。

package/templates/hosts/qoder/commands/wf-pr-review.md

@@ -0,0 +1,8 @@
+---
+name: wf-pr-review
+description: PR 面板评审——多子代理找 bug + 独立投票 + 三档台账 + 建 PR 前置门
+---
+
+权威命令：`.agents/commands/pr-review.md`
+
+本文件是指针壳。执行时读取权威源，不在此复制正文。

package/templates/hosts/qoder/commands/wf-review.md

@@ -0,0 +1,8 @@
+---
+name: wf-review
+description: 代码评审标准（按风险分级：机器兜底 + AI 自查出清单，用户决策定性和合入）
+---
+
+权威命令：`.agents/commands/review.md`
+
+本文件是指针壳。执行时读取权威源，不在此复制正文。

package/templates/hosts/qoder/commands/wf-stages.md

@@ -0,0 +1,8 @@
+---
+name: wf-stages
+description: L2/L3 阶段流（Plan/Design/Build/Test 四章合一）
+---
+
+权威命令：`.agents/commands/stages.md`
+
+本文件是指针壳。执行时读取权威源，不在此复制正文。

package/templates/hosts/qoder/settings.json

@@ -0,0 +1,63 @@
+{
+  "_comment": "Qoder 宿主本机接线（不入库，见 .git/info/exclude）。钩子实现单源 .agents/hooks/，本文件只留接线；permissions 镜像 .agents/settings.json 的 allow/deny/ask 基线。timeout 单位为秒。钩子走 exec 形式（command=node + args），省掉 bash 包装进程——shell 形式每次调用要 bash+node 两次 spawn，本会话实测有 2/20 次被宿主分发层报 Retry deadline exceeded 并整次拦下。",
+  "permissions": {
+    "allow": [
+      "Bash(dotnet build:*)",
+      "Bash(dotnet run:*)",
+      "Bash(npm run:*)",
+      "Bash(npm install:*)",
+      "Bash(npm ci:*)",
+      "Bash(node:*)",
+      "Bash(git status:*)",
+      "Bash(git diff:*)",
+      "Bash(git add:*)",
+      "Bash(git commit:*)",
+      "Bash(git log:*)",
+      "Bash(git push:*)",
+      "Bash(chrome:*)"
+    ],
+    "deny": [
+      "Bash(dotnet ef:*)",
+      "Bash(git reset --hard:*)",
+      "Bash(git push --force:*)",
+      "Bash(git push -f:*)",
+      "Bash(drop database:*)"
+    ],
+    "ask": [
+      "Bash(git checkout:*)",
+      "Bash(git clean:*)",
+      "Bash(git branch -D:*)",
+      "Bash(rm -rf:*)"
+    ]
+  },
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node",
+            "args": ["${QODER_PROJECT_DIR}/.agents/hooks/pre-shell-check.cjs"],
+            "name": "shell-gates",
+            "statusMessage": "命令门禁（deny/ask 清单 + .githooks pre-commit/pre-push 前置）",
+            "timeout": 600
+          }
+        ]
+      },
+      {
+        "matcher": "Edit|Write|NotebookEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node",
+            "args": ["${QODER_PROJECT_DIR}/.agents/hooks/pre-write-check.cjs"],
+            "name": "write-gates",
+            "statusMessage": "写前门（执法面自保护 / 台账 append-only / 红线快照-恢复）",
+            "timeout": 120
+          }
+        ]
+      }
+    ]
+  }
+}

package/templates/hosts/qwen/agents/implementer.md

@@ -0,0 +1,8 @@
+---
+name: implementer
+description: Implements an approved, tightly scoped code change or test when the task includes owned files and executable acceptance criteria
+model: inherit
+approvalMode: auto-edit
+---
+
+公共角色契约：`.agents/roles/implementer.md`。本文件只保留宿主 frontmatter。

package/templates/hosts/qwen/agents/independent-reviewer.md

@@ -0,0 +1,8 @@
+---
+name: independent-reviewer
+description: Independently reviews a fixed spec, plan, or code diff for correctness and project-rule violations without modifying files
+model: inherit
+approvalMode: plan
+---
+
+公共角色契约：`.agents/roles/independent-reviewer.md`。本文件只保留宿主 frontmatter。

package/templates/hosts/qwen/agents/pr-adjudicator.md

@@ -0,0 +1,8 @@
+---
+name: pr-adjudicator
+description: PR 面板评审的只读裁决者；处理 escalated 候选并返回裁决
+model: inherit
+approvalMode: plan
+---
+
+公共角色契约：`.agents/roles/pr-adjudicator.md`。本文件只保留宿主 frontmatter。

package/templates/hosts/qwen/agents/pr-finder.md

@@ -0,0 +1,8 @@
+---
+name: pr-finder
+description: PR 面板评审的只读 finder；按镜头独立找 bug，返回候选 JSON
+model: inherit
+approvalMode: plan
+---
+
+公共角色契约：`.agents/roles/pr-finder.md`。本文件只保留宿主 frontmatter。

package/templates/hosts/qwen/agents/pr-verifier.md

@@ -0,0 +1,8 @@
+---
+name: pr-verifier
+description: PR 面板评审的只读 verifier；独立验证单条候选并返回票 JSON
+model: inherit
+approvalMode: plan
+---
+
+公共角色契约：`.agents/roles/pr-verifier.md`。本文件只保留宿主 frontmatter。

package/templates/hosts/qwen/agents/ui-verifier.md

@@ -0,0 +1,8 @@
+---
+name: ui-verifier
+description: Runs browser-based verification for an implemented UI change and returns reproducible evidence without editing repository files
+model: inherit
+approvalMode: plan
+---
+
+公共角色契约：`.agents/roles/ui-verifier.md`。本文件只保留宿主 frontmatter。

package/templates/hosts/qwen/agents/wiki-compiler.md

@@ -0,0 +1,11 @@
+---
+name: wiki-compiler
+description: Translates a code commit into strict JSON describing what business capability the system gained, written for non-coding readers (product/customer service); read-only analysis, never edits files
+disallowedTools:
+  - write_file
+  - edit
+  - replace
+model: inherit
+---
+
+公共角色契约：`.agents/roles/wiki-compiler.md`。本文件只保留宿主 frontmatter。

package/templates/hosts/qwen/commands/wf-deploy.md

@@ -0,0 +1,9 @@
+---
+description: Deploy 阶段:合入清单(静态门 + 配对检查 + 回归 + DB + 授权 + PR 审查合并)
+---
+
+权威命令：`.agents/commands/deploy.md`
+
+本文件是指针壳。执行时读取权威源，不在此复制正文。
+
+用户随命令附带的参数：{{args}}

package/templates/hosts/qwen/commands/wf-maintain.md

@@ -0,0 +1,9 @@
+---
+description: Maintain 阶段:立 incident + 复盘三件套(修复 / 防复发 / 规范条目)
+---
+
+权威命令：`.agents/commands/maintain.md`
+
+本文件是指针壳。执行时读取权威源，不在此复制正文。
+
+用户随命令附带的参数：{{args}}

package/templates/hosts/qwen/commands/wf-new-task.md

@@ -0,0 +1,9 @@
+---
+description: AI-Native 闭环总入口:6 阶段指令索引(Plan→Design→Build→Test→Deploy→Maintain)
+---
+
+权威命令：`.agents/commands/new-task.md`
+
+本文件是指针壳。执行时读取权威源，不在此复制正文。
+
+用户随命令附带的参数：{{args}}

package/templates/hosts/qwen/commands/wf-pipeline-run.md

@@ -0,0 +1,9 @@
+---
+description: pipeline-run 自动化驱动入口——单命令驱动六阶段闭环（工单协议+机器门+原话代录）
+---
+
+权威命令：`.agents/commands/pipeline-run.md`
+
+本文件是指针壳。执行时读取权威源，不在此复制正文。
+
+用户随命令附带的参数：{{args}}

package/templates/hosts/qwen/commands/wf-pr-review.md

@@ -0,0 +1,9 @@
+---
+description: PR 面板评审（手动工具）——多子代理找 bug + 独立投票 + 台账；自动门已退役，按需手动跑
+---
+
+权威命令：`.agents/commands/pr-review.md`
+
+本文件是指针壳。执行时读取权威源，不在此复制正文。
+
+用户随命令附带的参数：{{args}}

package/templates/hosts/qwen/commands/wf-review.md

@@ -0,0 +1,9 @@
+---
+description: 代码评审标准（按风险分级：机器兜底 + AI 自查出清单，用户决策定性和合入）
+---
+
+权威命令：`.agents/commands/review.md`
+
+本文件是指针壳。执行时读取权威源，不在此复制正文。
+
+用户随命令附带的参数：{{args}}