c0de-agent 1.12.0 → 1.13.0

package/dist/kanban/store.js

@@ -1,15 +1,51 @@
-import { and, asc, eq, max } from 'drizzle-orm';
+import { and, asc, eq, inArray, isNotNull, isNull, max, sql } from 'drizzle-orm';
 import { kanbanBoards, kanbanCards } from '../db/schema.js';
 import { DEFAULT_KANBAN_COLUMNS } from '../shared/types/kanban.js';
 /** Default column when none is specified. */
 const DEFAULT_COLUMN_ID = 'todo';
 /** Position increment — large gap avoids frequent re-indexing on reorder. */
 const POSITION_GAP = 1000;
+/** 合法优先级枚举（运行时校验用——REST/tool 层输入未经 TS 约束）。 */
+const VALID_PRIORITIES = new Set(['high', 'medium', 'low']);
 /** 列内仍有卡片时禁止删除该列（否则卡片静默不可见）。 */
 class KanbanColumnInUseError extends Error {
-    constructor(columnNames, cardCount) {
+    constructor(columnNames, cardCount, cardIds = []) {
+        const idHint = cardIds.length > 0
+            ? `（示例卡片 id：${cardIds.slice(0, 5).join('、')}${cardIds.length > 5 ? ' 等' : ''}，可直接按 id 删除这些卡片）`
+            : '';
         super(`列 [${columnNames.join(', ')}] 中仍有 ${cardCount} 张卡片，无法删除。` +
-            '请先移动或删除这些卡片。');
+            `请先移动或删除这些卡片。${idHint}`);
+    }
+}
+/**
+ * 目标列不存在（add/move 引用未配置的列）——与 import/删列的悬空列防护同口径：
+ * 此前运行时 add/move 不校验，LLM 幻觉列名写入后卡片静默不可见，且幽灵卡片
+ * 会反过来冻结列配置删除（KanbanColumnInUseError 死锁）。
+ * 错误信息回传可用列清单，供 LLM 自纠而非再猜。
+ */
+class KanbanColumnNotFoundError extends Error {
+    columnId;
+    constructor(columnId, availableColumns, op) {
+        const avail = availableColumns.length > 0 ? availableColumns.join('、') : '（看板无列）';
+        super(`列 "${columnId}" 不存在，无法${op === 'add' ? '创建' : '移动'}卡片。` +
+            `可用列：${avail}。请改用其中一个列 id。`);
+        this.columnId = columnId;
+    }
+}
+/** 非法优先级（REST PATCH / kanbanTool 透传未校验值）。 */
+class KanbanInvalidPriorityError extends Error {
+    value;
+    constructor(value) {
+        super(`无效优先级 "${value}"，允许值：high、medium、low`);
+        this.value = value;
+    }
+}
+/** 卡片不存在（update/move 目标 id 无效）。 */
+class KanbanCardNotFoundError extends Error {
+    cardId;
+    constructor(cardId) {
+        super(`Kanban card not found: ${cardId}`);
+        this.cardId = cardId;
     }
 }
 // ── Row → API mappers ──────────────────────────────────────
@@ -57,9 +93,14 @@ function createKanbanStore(handle, projectId) {
         const [row] = await db
             .select({ id: kanbanBoards.id })
             .from(kanbanBoards)
-            .where(eq(kanbanBoards.projectId, projectId))
+            .where(and(eq(kanbanBoards.projectId, projectId), isNull(kanbanBoards.deletedAt)))
             .limit(1);
-        // 行一定存在：上面 insert + onConflictDoNothing 保证了 projectId 对应的行已创建
+        // 正常路径行一定存在（insert + onConflictDoNothing 已保证）。防御性兜底：
+        // 唯一 projectId 槽位被软删行占用等异常态下不再返回 undefined id
+        //（后续查询会静默查空、上层误判「板不存在」），显式抛错暴露问题。
+        if (!row) {
+            throw new Error(`Kanban board for project ${projectId} missing after ensure-insert (unique slot likely held by a soft-deleted row)`);
+        }
         return row.id;
     }
     /** Max position in a column (0 if empty). */
@@ -70,7 +111,45 @@ function createKanbanStore(handle, projectId) {
             .where(and(eq(kanbanCards.boardId, boardId), eq(kanbanCards.columnId, columnId)));
         return row?.m ?? 0;
     }
+    /** 当前板的列配置（add/move 的悬空列校验用）。 */
+    async function boardColumns(boardId) {
+        const [row] = await db
+            .select({ columns: kanbanBoards.columns })
+            .from(kanbanBoards)
+            .where(eq(kanbanBoards.id, boardId))
+            .limit(1);
+        return (row?.columns ?? []);
+    }
+    /** 校验列存在；不存在抛 KanbanColumnNotFoundError（消息含可用列清单）。 */
+    function assertColumn(columns, columnId, op) {
+        if (!columns.some((c) => c.id === columnId)) {
+            throw new KanbanColumnNotFoundError(columnId, columns.map((c) => c.id), op);
+        }
+    }
+    /** 校验优先级合法；非法抛 KanbanInvalidPriorityError。 */
+    function assertPriority(priority) {
+        if (priority !== undefined && !VALID_PRIORITIES.has(priority)) {
+            throw new KanbanInvalidPriorityError(String(priority));
+        }
+    }
     return {
+        /** 只读获取板（不创建）：导出等纯读路径用——此前导出经 getBoard 懒建板，
+         *  「导出」一个从未打开过看板的项目会凭空产生空板行。无板返回 null。 */
+        async peekBoard() {
+            const [boardRow] = await db
+                .select()
+                .from(kanbanBoards)
+                .where(and(eq(kanbanBoards.projectId, projectId), isNull(kanbanBoards.deletedAt)))
+                .limit(1);
+            if (!boardRow)
+                return null;
+            const cards = await db
+                .select()
+                .from(kanbanCards)
+                .where(eq(kanbanCards.boardId, boardRow.id))
+                .orderBy(asc(kanbanCards.columnId), asc(kanbanCards.position));
+            return { ...rowToBoard(boardRow), cards: cards.map(rowToCard) };
+        },
         async getBoard() {
             const boardId = await getOrCreateBoardId();
             const [boardRow] = await db
@@ -88,7 +167,12 @@ function createKanbanStore(handle, projectId) {
         },
         async addCard(input) {
             const boardId = await getOrCreateBoardId();
-            const columnId = input.columnId ?? DEFAULT_COLUMN_ID;
+            const columns = await boardColumns(boardId);
+            // 默认列 = 板上第一列（而非硬编码 'todo'）：todo 列被删除/重排后
+            // 硬编码默认会让无参 addCard 静默落入不存在的列（卡片不可见）。
+            const columnId = input.columnId ?? columns[0]?.id ?? DEFAULT_COLUMN_ID;
+            assertColumn(columns, columnId, 'add');
+            assertPriority(input.priority);
             const position = (await maxPos(boardId, columnId)) + POSITION_GAP;
             const [cardRow] = await db
                 .insert(kanbanCards)
@@ -106,6 +190,7 @@ function createKanbanStore(handle, projectId) {
             return rowToCard(row);
         },
         async updateCard(id, patch) {
+            assertPriority(patch.priority);
             const [row] = await db
                 .update(kanbanCards)
                 .set({
@@ -118,30 +203,29 @@ function createKanbanStore(handle, projectId) {
                 .where(eq(kanbanCards.id, id))
                 .returning();
             if (!row)
-                throw new Error(`Kanban card not found: ${id}`);
+                throw new KanbanCardNotFoundError(id);
             return rowToCard(row);
         },
         async moveCard(id, columnId, position) {
+            const [card] = await db
+                .select({ boardId: kanbanCards.boardId })
+                .from(kanbanCards)
+                .where(eq(kanbanCards.id, id))
+                .limit(1);
+            if (!card)
+                throw new KanbanCardNotFoundError(id);
+            // 悬空列校验：目标列必须存在于当前列配置，否则卡片静默不可见。
+            const columns = await boardColumns(card.boardId);
+            assertColumn(columns, columnId, 'move');
             // If no explicit position, append to end of target column.
-            let newPos = position;
-            if (newPos === undefined) {
-                const [card] = await db
-                    .select({ boardId: kanbanCards.boardId })
-                    .from(kanbanCards)
-                    .where(eq(kanbanCards.id, id))
-                    .limit(1);
-                if (!card)
-                    throw new Error(`Kanban card not found: ${id}`);
-                newPos = (await maxPos(card.boardId, columnId)) + POSITION_GAP;
-            }
+            const newPos = position ?? (await maxPos(card.boardId, columnId)) + POSITION_GAP;
             const [row] = await db
                 .update(kanbanCards)
                 .set({ columnId, position: newPos, updatedAt: new Date() })
                 .where(eq(kanbanCards.id, id))
                 .returning();
-            if (!row)
-                throw new Error(`Kanban card not found: ${id}`);
-            return rowToCard(row);
+            const moved = row;
+            return rowToCard(moved);
         },
         async deleteCard(id) {
             await db.delete(kanbanCards).where(eq(kanbanCards.id, id));
@@ -151,19 +235,21 @@ function createKanbanStore(handle, projectId) {
             // P1-4：删除列前校验该列内是否有卡片；删除标签前把悬空 labelId 从卡片上清掉。
             if (patch.columns !== undefined) {
                 const cards = await db
-                    .select({ columnId: kanbanCards.columnId })
+                    .select({ id: kanbanCards.id, columnId: kanbanCards.columnId })
                     .from(kanbanCards)
                     .where(eq(kanbanCards.boardId, boardId));
                 const newColumnIds = new Set(patch.columns.map((c) => c.id));
                 const removedWithCards = new Map();
+                const orphanCardIds = [];
                 for (const card of cards) {
                     if (!newColumnIds.has(card.columnId)) {
                         removedWithCards.set(card.columnId, (removedWithCards.get(card.columnId) ?? 0) + 1);
+                        orphanCardIds.push(card.id);
                     }
                 }
                 if (removedWithCards.size > 0) {
                     const total = Array.from(removedWithCards.values()).reduce((a, b) => a + b, 0);
-                    throw new KanbanColumnInUseError(Array.from(removedWithCards.keys()), total);
+                    throw new KanbanColumnInUseError(Array.from(removedWithCards.keys()), total, orphanCardIds);
                 }
             }
             if (patch.labels !== undefined) {
@@ -187,7 +273,7 @@ function createKanbanStore(handle, projectId) {
                 ...(patch.labels !== undefined && { labels: patch.labels }),
                 updatedAt: new Date(),
             })
-                .where(eq(kanbanBoards.projectId, projectId))
+                .where(and(eq(kanbanBoards.projectId, projectId), isNull(kanbanBoards.deletedAt)))
                 .returning();
             const row = boardRow;
             return rowToBoard(row);
@@ -229,4 +315,251 @@ function createKanbanStore(handle, projectId) {
         },
     };
 }
-export { createKanbanStore, KanbanColumnInUseError };
+export { createKanbanStore, KanbanCardNotFoundError, KanbanColumnInUseError, KanbanColumnNotFoundError, KanbanInvalidPriorityError, };
+/** 把活动看板软删除进回收站（记录原项目名与工作目录）。项目行删除后 FK 将 projectId 置 null。 */
+export async function softDeleteKanbanBoard(handle, projectId, projectName, worktree) {
+    const rows = await handle.db
+        .update(kanbanBoards)
+        .set({
+        deletedAt: new Date(),
+        deletedProjectName: projectName ?? undefined,
+        deletedProjectWorktree: worktree ?? undefined,
+        // 恢复后重删的看板须重新经历「到期 → 宽限」周期，宽限标记不跨删除周期生效。
+        purgePendingAt: null,
+        updatedAt: new Date(),
+    })
+        .where(and(eq(kanbanBoards.projectId, projectId), isNull(kanbanBoards.deletedAt)))
+        .returning({ id: kanbanBoards.id });
+    return rows.length > 0;
+}
+/** 行 + 卡片数 → 回收站条目（时间戳统一转 ms，兼容 Date/null/字符串）。 */
+function toDeletedBoard(b, cardCount) {
+    const toMs = (d) => {
+        if (d == null)
+            return null;
+        const t = d instanceof Date ? d.getTime() : new Date(d).getTime();
+        return Number.isFinite(t) ? t : null;
+    };
+    return {
+        id: b.id,
+        projectName: b.deletedProjectName ?? '未知项目',
+        cardCount,
+        deletedAt: toMs(b.deletedAt) ?? 0,
+        purgePendingAt: toMs(b.purgePendingAt),
+        deletedProjectWorktree: b.deletedProjectWorktree ?? null,
+    };
+}
+/** 回收站看板列表（含卡片数）。 */
+export async function listDeletedKanbanBoards(handle) {
+    const boards = await handle.db
+        .select()
+        .from(kanbanBoards)
+        .where(isNotNull(kanbanBoards.deletedAt))
+        .orderBy(asc(kanbanBoards.deletedAt));
+    if (boards.length === 0)
+        return [];
+    const counts = await handle.db
+        .select({ boardId: kanbanCards.boardId, n: sql `count(*)::int` })
+        .from(kanbanCards)
+        .where(inArray(kanbanCards.boardId, boards.map((b) => b.id)))
+        .groupBy(kanbanCards.boardId);
+    const countMap = new Map(counts.map((c) => [c.boardId, c.n]));
+    return boards.map((b) => toDeletedBoard(b, countMap.get(b.id) ?? 0));
+}
+/** 按 id 取单个回收站看板（供「重建原项目」恢复读取原工作目录）。 */
+export async function getDeletedKanbanBoard(handle, boardId) {
+    const [b] = await handle.db
+        .select()
+        .from(kanbanBoards)
+        .where(and(eq(kanbanBoards.id, boardId), isNotNull(kanbanBoards.deletedAt)))
+        .limit(1);
+    if (!b)
+        return null;
+    const counts = await handle.db
+        .select({ n: sql `count(*)::int` })
+        .from(kanbanCards)
+        .where(eq(kanbanCards.boardId, boardId));
+    return toDeletedBoard(b, counts[0]?.n ?? 0);
+}
+/** 恢复看板到指定项目：目标项目已有活动看板 → 409 语义（不覆盖用户现有看板）。
+ *  P2 修复：检查与更新放进单事务，并发下撞 uq_kanban_boards_project 唯一索引时
+ *  降级为 TARGET_HAS_BOARD（此前抛 PG 错误 500）。 */
+export async function restoreKanbanBoard(handle, boardId, projectId) {
+    try {
+        return await handle.db.transaction(async (tx) => {
+            const [active] = await tx
+                .select({ id: kanbanBoards.id })
+                .from(kanbanBoards)
+                .where(and(eq(kanbanBoards.projectId, projectId), isNull(kanbanBoards.deletedAt)))
+                .limit(1);
+            if (active)
+                return { ok: false, reason: 'TARGET_HAS_BOARD' };
+            const rows = await tx
+                .update(kanbanBoards)
+                .set({
+                projectId,
+                deletedAt: null,
+                deletedProjectName: null,
+                deletedProjectWorktree: null,
+                purgePendingAt: null,
+                updatedAt: new Date(),
+            })
+                .where(and(eq(kanbanBoards.id, boardId), isNotNull(kanbanBoards.deletedAt)))
+                .returning({ id: kanbanBoards.id });
+            if (rows.length === 0)
+                return { ok: false, reason: 'BOARD_NOT_FOUND' };
+            return { ok: true };
+        });
+    }
+    catch (err) {
+        // PG 23505 = unique_violation：并发窗口内目标板被创建。
+        if (err.code === '23505') {
+            return { ok: false, reason: 'TARGET_HAS_BOARD' };
+        }
+        throw err;
+    }
+}
+/**
+ * P1 修复：把回收站看板合并进目标项目的活动看板（TARGET_HAS_BOARD 死胡同的出口）。
+ * 此前「目标项目已有看板」时恢复 409，而产品没有删除活动看板的能力，用户无法
+ * 把旧项目卡片拿回现有项目——现在 merge 模式下：
+ *  - 目标无活动看板 → 等价普通恢复（重新归属）；
+ *  - 目标有活动看板 → 追加缺失列，卡片并入对应列末尾（position 重新计算避免
+ *    与目标卡片重叠）；源卡片引用源板已不存在列时落到目标第一列（保证可见）；
+ *  - 合并成功后源看板物理删除（卡片已迁移，FK cascade 清源卡）。
+ * 全程单事务：失败整体回滚，不残留半合并状态。
+ */
+export async function mergeKanbanBoard(handle, boardId, projectId) {
+    return await handle.db.transaction(async (tx) => {
+        const [src] = await tx
+            .select({ id: kanbanBoards.id, columns: kanbanBoards.columns })
+            .from(kanbanBoards)
+            .where(and(eq(kanbanBoards.id, boardId), isNotNull(kanbanBoards.deletedAt)))
+            .limit(1);
+        if (!src)
+            return { ok: false, reason: 'BOARD_NOT_FOUND' };
+        const [target] = await tx
+            .select({ id: kanbanBoards.id, columns: kanbanBoards.columns })
+            .from(kanbanBoards)
+            .where(and(eq(kanbanBoards.projectId, projectId), isNull(kanbanBoards.deletedAt)))
+            .limit(1);
+        // 目标无活动看板 → 重新归属（等价普通恢复，但保持 merge 调用幂等语义）。
+        if (!target) {
+            const rows = await tx
+                .update(kanbanBoards)
+                .set({
+                projectId,
+                deletedAt: null,
+                deletedProjectName: null,
+                deletedProjectWorktree: null,
+                purgePendingAt: null,
+                updatedAt: new Date(),
+            })
+                .where(and(eq(kanbanBoards.id, boardId), isNotNull(kanbanBoards.deletedAt)))
+                .returning({ id: kanbanBoards.id });
+            if (rows.length === 0)
+                return { ok: false, reason: 'BOARD_NOT_FOUND' };
+            return { ok: true, mergedColumns: 0, mergedCards: 0 };
+        }
+        // —— 合并路径 ——
+        const srcCols = (src.columns ?? []);
+        const targetCols = (target.columns ?? []);
+        const targetIds = new Set(targetCols.map((c) => c.id));
+        const newCols = srcCols.filter((c) => !targetIds.has(c.id));
+        if (newCols.length > 0) {
+            await tx
+                .update(kanbanBoards)
+                .set({ columns: [...targetCols, ...newCols], updatedAt: new Date() })
+                .where(eq(kanbanBoards.id, target.id));
+        }
+        const mergedCols = [...targetCols, ...newCols];
+        const fallbackCol = mergedCols[0]?.id ?? DEFAULT_COLUMN_ID;
+        const srcCards = await tx
+            .select()
+            .from(kanbanCards)
+            .where(eq(kanbanCards.boardId, boardId))
+            .orderBy(asc(kanbanCards.position));
+        // 目标各列现有 max(position)：合并卡片追加到末尾，避免 position 重叠。
+        const targetMax = await tx
+            .select({ columnId: kanbanCards.columnId, m: max(kanbanCards.position) })
+            .from(kanbanCards)
+            .where(eq(kanbanCards.boardId, target.id))
+            .groupBy(kanbanCards.columnId);
+        const maxMap = new Map(targetMax.map((r) => [r.columnId, r.m ?? 0]));
+        const counters = new Map();
+        let mergedCards = 0;
+        for (const card of srcCards) {
+            const colId = mergedCols.some((c) => c.id === card.columnId) ? card.columnId : fallbackCol;
+            const idx = counters.get(colId) ?? 0;
+            counters.set(colId, idx + 1);
+            await tx.insert(kanbanCards).values({
+                boardId: target.id,
+                title: card.title,
+                description: card.description,
+                columnId: colId,
+                priority: card.priority,
+                position: (maxMap.get(colId) ?? 0) + POSITION_GAP * (idx + 1),
+                labels: card.labels ?? [],
+            });
+            mergedCards += 1;
+        }
+        // 源看板物理删除（卡片已迁移；卡片行经 FK cascade 连带清除）。
+        await tx.delete(kanbanBoards).where(eq(kanbanBoards.id, boardId));
+        return { ok: true, mergedColumns: newCols.length, mergedCards };
+    });
+}
+/** 回收站内彻底删除看板（不可恢复）。 */
+export async function permanentlyDeleteKanbanBoard(handle, boardId) {
+    const rows = await handle.db
+        .delete(kanbanBoards)
+        .where(and(eq(kanbanBoards.id, boardId), isNotNull(kanbanBoards.deletedAt)))
+        .returning({ id: kanbanBoards.id });
+    return rows.length;
+}
+/**
+ * 看板回收站两阶段清理（与会话 purgeDeletedSessions 同策略，杜绝「到期即静默清空」）：
+ *  - 阶段一：软删除超过 retentionMs 且尚未标记 → 写 purgePendingAt（进入宽限期，
+ *    UI 显示「即将清除」仍可恢复）；
+ *  - 阶段二：purgePendingAt 早于 graceMs 截止 → 物理清除（卡片经 FK cascade 连带删除）。
+ * 看板回收站全局单一分组、无「首次查看才起算」语义，保留期自删除时刻起算，稳定可预期。
+ */
+export async function purgeDeletedKanbanBoards(handle, retentionMs, graceMs) {
+    const retentionCutoff = new Date(Date.now() - retentionMs);
+    const graceCutoff = new Date(Date.now() - graceMs);
+    const rows = await handle.db
+        .select({
+        id: kanbanBoards.id,
+        deletedAt: kanbanBoards.deletedAt,
+        purgePendingAt: kanbanBoards.purgePendingAt,
+    })
+        .from(kanbanBoards)
+        .where(isNotNull(kanbanBoards.deletedAt));
+    // —— 阶段一：到期标记（先宽限，不直接清除）——
+    let marked = 0;
+    for (const r of rows) {
+        if (!r.deletedAt)
+            continue;
+        if (r.purgePendingAt)
+            continue;
+        if (r.deletedAt.getTime() >= retentionCutoff.getTime())
+            continue;
+        await handle.db
+            .update(kanbanBoards)
+            .set({ purgePendingAt: new Date(), updatedAt: new Date() })
+            .where(eq(kanbanBoards.id, r.id));
+        marked += 1;
+    }
+    // —— 阶段二：宽限期满物理清除 ——
+    const pendingIds = rows
+        .filter((r) => r.purgePendingAt && r.purgePendingAt.getTime() < graceCutoff.getTime())
+        .map((r) => r.id);
+    let deleted = 0;
+    if (pendingIds.length > 0) {
+        const removed = await handle.db
+            .delete(kanbanBoards)
+            .where(inArray(kanbanBoards.id, pendingIds))
+            .returning({ id: kanbanBoards.id });
+        deleted = removed.length;
+    }
+    return { marked, deleted };
+}

package/dist/llm/registry.d.ts

@@ -81,7 +81,13 @@ declare const setRole: (registry: Registry, role: ModelRole, provider: string, m
  * live request handlers (e.g. config hot-reload).
  */
 declare const rebuildRegistry: (registry: Registry, builder: (next: Registry) => void) => void;
+/**
+ * 内置价目表版本（H3）：记录 builtinCapabilities 最近一次人工核价的日期。
+ * LLM 价格频繁变动，前端在用量/成本面板展示此版本提醒「估算可能过期」；
+ * 发布新版本时同步核对 builtinCapabilities 并更新此常量（release checklist）。
+ */
+declare const PRICE_CATALOG_VERSION = "2026-09-09";
 /** Default role + a starter catalog of well-known models. */
 declare const builtinCapabilities: Record<string, Record<string, ModelCapabilities>>;
 export type { ProviderInput, Registry, ResolveResult, RouteEntry, RouteTable };
-export { builtinCapabilities, createRegistry, DEFAULT_MODEL_CAPABILITIES, overrideToCapabilities, rebuildRegistry, registerProvider, resolveModelByRole, resolveRoute, setRole, };
+export { builtinCapabilities, createRegistry, DEFAULT_MODEL_CAPABILITIES, overrideToCapabilities, PRICE_CATALOG_VERSION, rebuildRegistry, registerProvider, resolveModelByRole, resolveRoute, setRole, };

package/dist/llm/registry.js

@@ -117,6 +117,12 @@ const rebuildRegistry = (registry, builder) => {
     builder(next);
     registry.table = next.table;
 };
+/**
+ * 内置价目表版本（H3）：记录 builtinCapabilities 最近一次人工核价的日期。
+ * LLM 价格频繁变动，前端在用量/成本面板展示此版本提醒「估算可能过期」；
+ * 发布新版本时同步核对 builtinCapabilities 并更新此常量（release checklist）。
+ */
+const PRICE_CATALOG_VERSION = '2026-09-09';
 /** Default role + a starter catalog of well-known models. */
 const builtinCapabilities = {
     openai: {
@@ -151,4 +157,4 @@ const builtinCapabilities = {
         },
     },
 };
-export { builtinCapabilities, createRegistry, DEFAULT_MODEL_CAPABILITIES, overrideToCapabilities, rebuildRegistry, registerProvider, resolveModelByRole, resolveRoute, setRole, };
+export { builtinCapabilities, createRegistry, DEFAULT_MODEL_CAPABILITIES, overrideToCapabilities, PRICE_CATALOG_VERSION, rebuildRegistry, registerProvider, resolveModelByRole, resolveRoute, setRole, };

package/dist/plugins/init.d.ts

@@ -7,6 +7,11 @@ type InitPluginsOptions = {
     toolRegistry: unknown;
     /** LLM 注册表；插件通过 registerProvider 往这里注入。 */
     llmRegistry: unknown;
+    /**
+     * P0-2：项目已显式信任（projects.trustedAt 非空）时才加载项目 .c0de/plugins。
+     * 缺省 false（fail-closed）：克隆仓库自带插件不会在 serve/chat 时静默执行。
+     */
+    projectTrusted?: boolean;
 };
 type InitPluginsResult = {
     pluginRegistry: PluginRegistry;
@@ -17,6 +22,8 @@ type InitPluginsResult = {
  *
  * 失败的外部插件被静默跳过（loader 已处理），单个坏插件不影响其余加载。
  * 内置插件（tool-audit-log / write-guard）始终激活。
+ * P0-2：项目插件仅在项目被显式信任后加载（跳过时若目录非空则告警并给出
+ * 信任途径）；全局插件是用户本机显式放置，始终加载。
  */
 declare function initPlugins(opts: InitPluginsOptions): Promise<InitPluginsResult>;
 export type { InitPluginsOptions, InitPluginsResult };

package/dist/plugins/init.js

@@ -1,3 +1,8 @@
+// 插件系统初始化编排（spec §7）：创建 hookRunner + pluginRegistry，激活内置插件，
+// 发现并加载外部插件（.c0de/plugins + ~/.c0de/plugins）。供 server bootstrap 与
+// CLI buildAgentDeps 复用——两处启动路径此前都未接入，导致插件框架存在却永不加载。
+import { existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
 import { registerBuiltinHooks } from './builtin.js';
 import { createHookRunner } from './hooks.js';
 import { activatePlugin } from './lifecycle.js';
@@ -8,6 +13,8 @@ import { createPluginRegistry, registerPlugin } from './registry.js';
  *
  * 失败的外部插件被静默跳过（loader 已处理），单个坏插件不影响其余加载。
  * 内置插件（tool-audit-log / write-guard）始终激活。
+ * P0-2：项目插件仅在项目被显式信任后加载（跳过时若目录非空则告警并给出
+ * 信任途径）；全局插件是用户本机显式放置，始终加载。
  */
 async function initPlugins(opts) {
     const hookRunner = createHookRunner();
@@ -20,7 +27,21 @@ async function initPlugins(opts) {
     // 内置插件先激活：它们注册 tool:before/after hook，对后续外部插件同样生效。
     await registerBuiltinHooks(pluginRegistry, services);
     // 发现并加载外部插件（项目 .c0de/plugins 与全局 ~/.c0de/plugins）。
-    const discovered = await discoverPlugins(opts.cwd);
+    const projectPluginsDir = join(opts.cwd, '.c0de', 'plugins');
+    if (opts.projectTrusted !== true) {
+        try {
+            if (existsSync(projectPluginsDir) && readdirSync(projectPluginsDir).length > 0) {
+                console.warn(`[plugin] 项目插件目录 ${projectPluginsDir} 存在插件，但项目尚未被信任（或信任后风险配置/插件代码已变更）——已跳过加载。\n` +
+                    `  信任/重新确认方式：c0de trust（CLI），或在 Web 界面遇到信任确认时点击「信任项目」；信任后重启 serve 生效。`);
+            }
+        }
+        catch {
+            // 目录读取失败不影响启动
+        }
+    }
+    const discovered = await discoverPlugins(opts.cwd, {
+        includeProject: opts.projectTrusted === true,
+    });
     for (const { plugin } of discovered) {
         registerPlugin(pluginRegistry, plugin);
         await activatePlugin(pluginRegistry, plugin, services);

package/dist/plugins/loader.d.ts

@@ -8,7 +8,13 @@ type ValidationResult = {
 };
 declare function validatePluginModule(mod: unknown): ValidationResult;
 declare function loadPlugin(path: string): Promise<Plugin>;
-declare function discoverPlugins(projectDir: string): Promise<{
+declare function discoverPlugins(projectDir: string, 
+/** P0-2：includeProject=false 时跳过项目 .c0de/plugins（未信任项目不加载，
+ *  信任后重启生效）；全局插件目录（默认 ~/.c0de/plugins，C0DE_CONFIG_DIR 可重定向）
+ *  始终加载（用户本机显式放置）。 */
+opts?: {
+    includeProject?: boolean;
+}): Promise<{
     name: string;
     path: string;
     plugin: Plugin;

package/dist/plugins/loader.js

@@ -1,7 +1,7 @@
 // src/plugins/loader.ts
 import { existsSync, readdirSync, statSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { resolveGlobalConfigDir } from '../core/config.js';
 function validatePluginModule(mod) {
     const candidate = mod?.default ?? mod;
     if (typeof candidate !== 'object' || candidate === null) {
@@ -49,10 +49,18 @@ function scanPluginDir(dir) {
     }
     return plugins;
 }
-async function discoverPlugins(projectDir) {
+async function discoverPlugins(projectDir, 
+/** P0-2：includeProject=false 时跳过项目 .c0de/plugins（未信任项目不加载，
+ *  信任后重启生效）；全局插件目录（默认 ~/.c0de/plugins，C0DE_CONFIG_DIR 可重定向）
+ *  始终加载（用户本机显式放置）。 */
+opts = {}) {
     const projectPluginsDir = join(projectDir, '.c0de', 'plugins');
-    const globalPluginsDir = join(homedir(), '.c0de', 'plugins');
-    const discovered = [...scanPluginDir(projectPluginsDir), ...scanPluginDir(globalPluginsDir)];
+    // 全局插件根（默认 ~/.c0de/plugins，C0DE_CONFIG_DIR 可重定向）。
+    const globalPluginsDir = join(resolveGlobalConfigDir(), 'plugins');
+    const discovered = [
+        ...(opts.includeProject === false ? [] : scanPluginDir(projectPluginsDir)),
+        ...scanPluginDir(globalPluginsDir),
+    ];
     const results = [];
     for (const entry of discovered) {
         try {

package/dist/project/index.d.ts

@@ -1,4 +1,4 @@
 export type { Project } from './project.js';
-export { fromDirectory, getByDirectory, getProject, listProjects, relocateProject, updateProjectName, } from './project.js';
+export { enforceProjectTrust, fromDirectory, getByDirectory, getProject, listProjects, relocateProject, trustProject, updateProjectName, } from './project.js';
 export type { ResolvedProject } from './resolve.js';
 export { resolveProject } from './resolve.js';

package/dist/project/index.js

@@ -1,2 +1,2 @@
-export { fromDirectory, getByDirectory, getProject, listProjects, relocateProject, updateProjectName, } from './project.js';
+export { enforceProjectTrust, fromDirectory, getByDirectory, getProject, listProjects, relocateProject, trustProject, updateProjectName, } from './project.js';
 export { resolveProject } from './resolve.js';

package/dist/project/project.d.ts

@@ -1,4 +1,5 @@
 import type { DB } from '../db/client.js';
+import type { Config } from '../shared/types/config.js';
 export type Project = {
     id: string;
     worktree: string;
@@ -7,6 +8,10 @@ export type Project = {
     gitRemote: string | null;
     createdAt: number;
     updatedAt: number;
+    /** 用户显式信任该项目作用域配置/插件的时间戳；null=未信任（P0-2 信任边界）。 */
+    trustedAt: number | null;
+    /** 信任时的风险配置指纹；null=历史记录（无指纹，见 schema 注释）。 */
+    riskFingerprint: string | null;
 };
 /**
  * 解析目录 + upsert 项目记录。返回 Project。
@@ -21,6 +26,24 @@ export declare function listProjects(handle: DB): Promise<Project[]>;
 export declare function getProject(handle: DB, id: string): Promise<Project | null>;
 export declare function getByDirectory(handle: DB, directory: string): Promise<Project | null>;
 export declare function updateProjectName(handle: DB, id: string, name: string): Promise<Project | null>;
+/**
+ * P0-2：显式信任项目——用户在信任确认弹窗中批准项目作用域配置/插件后落盘。
+ * 信任是「克隆即信任」防线的落点；未信任项目携带风险配置时聊天入口被门禁拦截。
+ * 一次性动作：信任后不再拦截（用户可随时在设置中收回项目级配置）。
+ * P1：信任时同时落盘「风险配置指纹」（当前项目作用域的 summarizeProjectRisk
+ * 快照）——此后若仓库 git pull 新增 auto 权限/插件/MCP 等风险键，指纹漂移会
+ * 重新触发门禁复检，而非永久信任。
+ */
+export declare function trustProject(handle: DB, id: string): Promise<Project | null>;
+/**
+ * P0 CLI 项目信任门禁：agent 执行路径（c0de chat / c0de acp）在无 Web 确认弹窗的
+ * 情况下，若目录项目未信任（或信任后未 config 漂移）且项目作用域/全局权限配置含
+ * 风险项，直接抛错引导 `c0de trust <dir>`——与 Web 聊天入口 409 TRUST_REQUIRED 用
+ * 同一套 projectTrustNeeded 判定，杜绝「Web 拦、CLI 裸奔」的不对称。
+ * 无风险项时不拦；trust/sessions 等非 agent 命令由调用方跳过此门禁。
+ * `globalRaw` 参数仅供测试注入确定性全局配置（生产走本机 ~/.c0de/config.json）。
+ */
+export declare function enforceProjectTrust(handle: DB, cwd: string, globalRaw?: Partial<Config> | undefined): Promise<void>;
 /**
  * 项目重新定位（A1：目录被移动/重命名后的恢复通道）。
  *