cmdr-mcp 0.1.0

package/docs/implementation.md

@@ -0,0 +1,71 @@
+# Implementation and verification
+
+This is the first source implementation on the repository's previously documentation-only branch. The design's historical v0.1.x trial reports described a prior prototype; they are not test evidence for this implementation. This release is versioned from `package.json` as **0.1.0**, internal protocol **1**.
+
+## Delivered behavior
+
+- A single on-demand daemon, Unix socket, SQLite WAL persistence, exclusive process lock, spawn coordination, idle exit, retention cleanup, log rotation and version-based replacement.
+- Seven MCP stdio tools with input limits, role enforcement, atomic named squads, priorities, queue backpressure, sender rate limits, correlated asks/answers, peek/history and cancellable long polling.
+- Orphan/takeover/dissolve semantics, stable native identities, provisional identity migration, resume/reconnect, per-stamped-session MCP connections, Claude clear rebinding, cwd filtering and derived titles.
+- Lifecycle hooks with a flag-file fast path, metadata-only reminders, repeat throttling, actionable Stop interception, compact/resume context and fail-open behavior.
+- Operator status/list/tail/send/read, daemon controls, cleanup, environment diagnostics and printable MCP configuration.
+- Claude, Codex and native ZCode plugin manifests; shared commands, skills and bundled entry points; generic MCP host support without hardcoded host restrictions.
+- CI for macOS/Linux and Node 22/24; bundled dependencies and their license notices are generated by prepack and included in npm packages, never tracked in Git.
+
+## Deliberate clarifications to the design
+
+Generated `dist` files and license notices are excluded from Git, including this PR branch's history. `prepack` builds the publishable npm package; explicit package files and executable mappings include the runtime and all host plugin metadata. Source marketplace installation requires a build first. CI packs the real tarball and installs it offline into a temporary prefix, testing the CLI and seven MCP tools without external runtime dependencies. No registry publication is performed by this PR.
+
+Tool schemas live in `shared/schemas.ts` separately from protocol/error types, so the CLI and hook do not pull in Zod just to handle RPC errors.
+
+`join(squad_name)` is the atomic shortcut. `role` becomes optional only for this form; explicit `join(role, squad, name)` is retained. A single daemon transaction and partial unique index enforce live-name uniqueness. An executor can explicitly take over its own orphaned squad without a temporary departure.
+
+The internal `Session.agent` is an open identifier. The bridge allocates one daemon connection per stamped session when a desktop host pools one MCP process. Unstamped hosts must use one process per session or explicitly inject unique native IDs. This replaces the prototype's “ignore a different stamp” limitation.
+
+SQLite stores typed JSON payloads plus indexed columns for queues, message sequence, live names and membership constraints. It does not duplicate the draft appendix schema column-for-column. Node 22.5's null-filled result for an unmatched SQLite `get()` is normalized at the store boundary; wrappers and test workers enable experimental SQLite for that runtime.
+
+Reports include their status in `message.data.status`. Executor join replies instruct reporting ready instead of claiming that a report has already been sent. Metadata hooks do not include report bodies or user attachments.
+
+Cancellation is propagated from MCP through the Unix socket (`rpc.cancel`). Disconnect/cancellation before a waiting read resumes preserves the queued message. The documented “read is delivery” rule still applies: there is no processing acknowledgement or exactly-once guarantee after a result has been returned. History remains available for recovery.
+
+`doctor` reports host/runtime availability, bundles, daemon, Codex MCP registration and hook enablement indicators. It does not guess Codex's private trust-file schema or invent a trusted-hook count: the output asks the user to verify the five hook approvals in the host UI.
+
+## Automated verification
+
+The checked-in suite has **38 tests** across four files:
+
+| Coverage | Evidence |
+| --- | --- |
+| Core | Atomic names, idempotency, role restrictions, arbitrary Agent IDs, ambiguous recipients, priority/peek/history, orphan/takeover/dissolve, inbox transfer, broadcast rollback, rate/size limits, persistence |
+| Hooks/identity | Provisional merge and reply routing, queue/waiter migration, clear rebinding, connection-count presence, reminder throttling, Stop attention rules, context restoration, TTL, cancellation |
+| Utilities | Host detection and namespaces, timeout negotiation, symlink/cwd handling, Codex/Claude titles, socket path fallback, lock recovery and config defaults |
+| Real processes | Bundled MCP tool discovery, simultaneous daemon startup, messaging/ask/read, graceful restart, SIGKILL recovery, version upgrade, pooled ZCode session isolation, hook executable behavior, protocol rejection, end-to-end MCP cancellation |
+
+Validation commands:
+
+```sh
+npm run check
+npm exec --yes --package=node@22.5.0 -- node node_modules/vitest/vitest.mjs run
+claude plugin validate plugins/cmdr
+claude plugin validate .
+npm run verify:zcode
+```
+
+Codex plugin structure is also checked with the plugin-creator manifest validator. The local verification environment is macOS with Node 24.16.0 and the minimum supported Node 22.5.0. CI adds Linux and current Node 22 coverage.
+
+## ZCode desktop runtime verification
+
+On 2026-09-08, the installed **ZCode 3.11.2 (build 3.11.2.6792)** and its bundled **Agent runtime 0.16.5** passed the reproducible `verify:zcode` check:
+
+- Native marketplace/plugin validation: `ok: true`, no diagnostics.
+- Installation into an isolated temporary workspace/runtime registry.
+- Discovered components: `command=1`, `skill=3`, `hook=4`, `mcp=1`.
+- Namespaced server `plugin:cmdr:cmdr`: `status=connected`, `transport=stdio`, `toolCount=7`.
+
+The probe uses the actual app-server in desktop surface mode. It neither changes the user's normal plugin registry nor sends model requests. The shared-process session isolation and hook stamp/Stop contracts are exercised separately by automated process tests.
+
+## Remaining manual checks
+
+GUI-driven model collaboration across Claude Desktop, Codex Desktop and ZCode Desktop has not been claimed as verified by this PR. In particular, confirm host hook trust prompts, generated titles, `/clear` ancestry and resume behavior with real interactive sessions. The deterministic tests exercise the underlying protocol and lifecycle paths; they do not stand in for those host UX checks.
+
+Windows, remote machines, active wakeups and creation of new Agent sessions are outside this Unix-socket v1 scope. Generic compatibility means an open MCP adapter contract, not a claim that every proprietary Agent host has been individually tested.

package/docs/publishing.md

@@ -0,0 +1,52 @@
+# npm 发布
+
+首次版本为 `cmdr-mcp@0.1.0`。npm 包名是 `cmdr-mcp`，CLI、宿主插件和 marketplace 名称仍为 `cmdr`。安装后的包根目录是 `$(npm root -g)/cmdr-mcp`。
+
+## 准备与验证
+
+在 macOS / Linux、Node.js ≥22.5（推荐 24）环境，从仓库根目录执行：
+
+```sh
+npm ci
+npm run check
+npm pack
+npm publish ./cmdr-mcp-0.1.0.tgz --dry-run --access public --registry https://registry.npmjs.org/
+```
+
+`npm run check` 包括格式、类型、构建、测试以及临时目录中的 npm 包离线安装验证：检查发布资源、安装后 marketplace 路径、CLI 和 7 个 MCP 工具。`npm pack` 通过 `prepack` 生成 4 个运行入口及第三方许可证声明，输出 `cmdr-mcp-0.1.0.tgz`。源码、测试和开发依赖不进入发布包。
+
+检查 `git diff`，确认版本与预期一致，构建未意外修改宿主 manifests。发布前保留经过验证的源码提交；不要手改或提交 `plugins/cmdr/dist/`、`THIRD_PARTY_NOTICES.txt` 和 `.tgz`。
+
+`--dry-run` 不发布包，也不能证明账号有发布权限或包名一定可注册。GUI 安装、信任提示和真实模型协作需单独验证，不能用自动化测试替代。
+
+## 首次发布
+
+准备完成后，由发布者登录公共 npm，并确认账号和包名：
+
+```sh
+npm login --registry https://registry.npmjs.org/
+npm whoami --registry https://registry.npmjs.org/
+npm view cmdr-mcp name version --registry https://registry.npmjs.org/
+```
+
+首次发布前，包名查询应返回 E404；网络或身份验证错误不能作为名称可用的依据。如果包已存在，先核对所有权和版本。名称是否可用最终由 npm 发布校验决定。
+
+确认发布时，上传已检查的 tarball，并按 npm 提示完成账号验证：
+
+```sh
+npm publish ./cmdr-mcp-0.1.0.tgz --access public --registry https://registry.npmjs.org/
+```
+
+此命令会公开发布 `0.1.0` 并使用默认的 `latest` 标签。相同包名和版本不能重复发布；后续修改需要提升版本并重新构建验证。发布使用 tarball，以保持上传内容与已检查产物一致。
+
+## 发布后核对
+
+```sh
+npm view cmdr-mcp@0.1.0 name version dist.integrity --registry https://registry.npmjs.org/
+npm install --global cmdr-mcp@0.1.0 --registry https://registry.npmjs.org/
+cmdr --help
+```
+
+按照 [安装说明](README.zh-CN.md#安装) 注册安装后的包根目录。已安装宿主有插件缓存，升级后需要刷新或重装；同版本测试代码变动需要重启对应测试 daemon。
+
+npm 命令行为参考：[npm publish 官方文档](https://docs.npmjs.com/cli/v11/commands/npm-publish/)。

package/marketplace.json

@@ -0,0 +1,12 @@
+{
+  "name": "cmdr",
+  "plugins": [
+    {
+      "name": "cmdr",
+      "source": "./plugins/cmdr",
+      "version": "0.1.0",
+      "description": "Local multi-agent squads with durable messages, roles and lifecycle reminders."
+    }
+  ],
+  "description": "Local multi-agent squads for Claude Code, Codex, ZCode and other MCP hosts."
+}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "cmdr-mcp",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Local multi-agent squads for Claude Code, Codex, ZCode and any MCP host",
+  "engines": {
+    "node": ">=22.5.0"
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "check": "npm run format:check && npm run typecheck && npm run build && npm test && npm run verify:package",
+    "format": "prettier --write src tests scripts package.json tsconfig.json .prettierrc.json vitest.config.ts",
+    "format:check": "prettier --check src tests scripts package.json tsconfig.json .prettierrc.json vitest.config.ts",
+    "verify:zcode": "node scripts/verify-zcode.mjs",
+    "prepack": "npm run build",
+    "verify:package": "node scripts/verify-package.mjs"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "esbuild": "^0.25.0",
+    "prettier": "^3.9.6",
+    "typescript": "^5.9.0",
+    "vitest": "^3.2.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^3.25.0"
+  },
+  "files": [
+    "plugins/cmdr/",
+    "plugins/cmdr/dist/*.mjs",
+    "plugins/cmdr/THIRD_PARTY_NOTICES.txt",
+    ".agents/plugins/marketplace.json",
+    ".claude-plugin/marketplace.json",
+    "marketplace.json",
+    "docs/"
+  ],
+  "bin": {
+    "cmdr": "plugins/cmdr/dist/cli.mjs",
+    "cmdr-mcp": "plugins/cmdr/dist/mcp.mjs",
+    "cmdr-hook": "plugins/cmdr/dist/hook.mjs",
+    "cmdr-daemon": "plugins/cmdr/dist/daemon.mjs"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/njugray/cmdr.git"
+  },
+  "homepage": "https://github.com/njugray/cmdr#readme",
+  "bugs": {
+    "url": "https://github.com/njugray/cmdr/issues"
+  },
+  "keywords": [
+    "mcp",
+    "agents",
+    "multi-agent",
+    "coordination",
+    "cli"
+  ],
+  "os": [
+    "darwin",
+    "linux"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}

package/plugins/cmdr/.claude-plugin/plugin.json

@@ -0,0 +1,10 @@
+{
+  "name": "cmdr",
+  "version": "0.1.0",
+  "description": "Local multi-agent squads with durable messages, roles and lifecycle reminders.",
+  "author": {
+    "name": "njugray"
+  },
+  "license": "MIT",
+  "repository": "https://github.com/njugray/cmdr"
+}

package/plugins/cmdr/.codex-plugin/plugin.json

@@ -0,0 +1,34 @@
+{
+  "name": "cmdr",
+  "version": "0.1.0",
+  "description": "Local multi-agent squads with durable messages, roles and lifecycle reminders.",
+  "author": {
+    "name": "njugray"
+  },
+  "license": "MIT",
+  "repository": "https://github.com/njugray/cmdr",
+  "skills": "./skills/",
+  "mcpServers": {
+    "cmdr": {
+      "command": "./bin/cmdr-mcp",
+      "cwd": ".",
+      "env": {
+        "CMDR_AGENT": "codex",
+        "CMDR_TOOL_TIMEOUT_SEC": "600"
+      },
+      "env_vars": [
+        "CODEX_HOME"
+      ],
+      "tool_timeout_sec": 600
+    }
+  },
+  "interface": {
+    "displayName": "cmdr",
+    "category": "Developer Tools",
+    "shortDescription": "Coordinate local coding-agent sessions.",
+    "longDescription": "Connect local coding-agent sessions in squads with persistent messages, explicit roles, and lifecycle reminders.",
+    "developerName": "njugray",
+    "defaultPrompt": "Create or join a cmdr squad.",
+    "capabilities": []
+  }
+}

package/plugins/cmdr/.mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "cmdr": {
+      "type": "stdio",
+      "command": "${CLAUDE_PLUGIN_ROOT}/bin/cmdr-mcp",
+      "env": {
+        "CMDR_PLUGIN_ROOT": "${CLAUDE_PLUGIN_ROOT}"
+      }
+    }
+  }
+}

package/plugins/cmdr/.zcode-plugin/plugin.json

@@ -0,0 +1,24 @@
+{
+  "name": "cmdr",
+  "version": "0.1.0",
+  "description": "Local multi-agent squads with durable messages, roles and lifecycle reminders.",
+  "author": {
+    "name": "njugray"
+  },
+  "license": "MIT",
+  "repository": "https://github.com/njugray/cmdr",
+  "skills": "./skills/",
+  "commands": "./commands/",
+  "mcpServers": {
+    "cmdr": {
+      "type": "stdio",
+      "command": "${ZCODE_PLUGIN_ROOT}/bin/cmdr-mcp",
+      "cwd": "${CLAUDE_PROJECT_DIR}",
+      "env": {
+        "CMDR_AGENT": "zcode",
+        "CMDR_TOOL_TIMEOUT_SEC": "600"
+      },
+      "timeoutMs": 600000
+    }
+  }
+}

package/plugins/cmdr/README.md

@@ -0,0 +1,15 @@
+# cmdr plugin
+
+Connect local Claude Code, Codex, ZCode and other MCP-capable sessions as a squad. Requires macOS/Linux and Node.js ≥22.5 (24 recommended); npm distribution packages include all runtime dependencies. A source checkout requires `npm ci && npm run build` at the repository root before installation; generated `dist` files are not tracked by Git.
+
+In each session enter `/cmdr my-project`. The first becomes commander; others join as executors. Without slash commands, ask the Agent to call `join(squad_name="my-project")`.
+
+Tools: `join`, `list`, `send`, `report`, `ask`, `read`, `leave`. Executors report ready with capabilities/cwd, then read tasks, report results and ask when blocked. Commanders dispatch verifiable tasks and answer questions with `reply_to`. Use each result's `me.recommended_wait` for long polling; the skills limit standby to 40 rounds.
+
+Install a built checkout or the unpacked/installed npm package root as a marketplace in Claude Code/Codex, or use ZCode Settings → Plugins → Create → Add plugin marketplace. Codex needs hooks enabled and five hook approvals; start a new session after installation. ZCode uses its native manifest and four supported hooks; MCP EOF handles offline state. Generic hosts can configure the absolute `bin/cmdr-mcp` executable and `CMDR_AGENT=<host>` with optional `CMDR_SESSION_ID=<unique native session>`.
+
+`bin/cmdr config --agent zcode` prints native ZCode configuration; `bin/cmdr config --agent my-agent` prints generic MCP configuration. `bin/cmdr doctor` checks installation health. `bin/cmdr daemon restart` reloads same-version code changes. State lives in `~/.cmdr/` (override `CMDR_HOME`), shared by all sessions.
+
+No active wakeups, Agent launching, remote transport or execution of message contents. Read marks delivery; use history if a host loses a previously delivered result. Idle recipients may need the user to say “continue”.
+
+[Installation and usage](https://github.com/njugray/cmdr#readme) · [Host integration](https://github.com/njugray/cmdr/blob/main/docs/agent-integration.md) · [Verification scope](https://github.com/njugray/cmdr/blob/main/docs/implementation.md)

package/plugins/cmdr/THIRD_PARTY_NOTICES.txt

@@ -0,0 +1,207 @@
+@modelcontextprotocol/sdk 1.30.0 (MIT)
+MIT License
+
+Copyright (c) 2024 Anthropic, PBC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+========================================================================
+
+ajv 8.20.0 (MIT)
+The MIT License (MIT)
+
+Copyright (c) 2015-2021 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+
+========================================================================
+
+ajv-formats 3.0.1 (MIT)
+MIT License
+
+Copyright (c) 2020 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+========================================================================
+
+fast-deep-equal 3.1.3 (MIT)
+MIT License
+
+Copyright (c) 2017 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+========================================================================
+
+fast-uri 3.1.7 (BSD-3-Clause)
+Copyright (c) 2011-2021, Gary Court until https://github.com/garycourt/uri-js/commit/a1acf730b4bba3f1097c9f52e7d9d3aba8cdcaae
+Copyright (c) 2021-present The Fastify team <https://github.com/fastify/fastify#team>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * The names of any contributors may not be used to endorse or promote
+      products derived from this software without specific prior written
+      permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+                                  *   *   *
+
+The complete list of contributors can be found at:
+- https://github.com/garycourt/uri-js/graphs/contributors
+
+========================================================================
+
+json-schema-traverse 1.0.0 (MIT)
+MIT License
+
+Copyright (c) 2017 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+========================================================================
+
+zod 3.25.76 (MIT)
+MIT License
+
+Copyright (c) 2025 Colin McDonnell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+========================================================================
+
+zod-to-json-schema 3.25.2 (ISC)
+ISC License
+
+Copyright (c) 2020, Stefan Terdell
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/plugins/cmdr/bin/cmdr

@@ -0,0 +1,4 @@
+#!/bin/sh
+CMDR_BIN_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+export CMDR_BIN_DIR
+exec "$CMDR_BIN_DIR/cmdr-node" cli "$@"

package/plugins/cmdr/bin/cmdr-daemon

@@ -0,0 +1,4 @@
+#!/bin/sh
+CMDR_BIN_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+export CMDR_BIN_DIR
+exec "$CMDR_BIN_DIR/cmdr-node" daemon "$@"

package/plugins/cmdr/bin/cmdr-hook

@@ -0,0 +1,4 @@
+#!/bin/sh
+CMDR_BIN_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+export CMDR_BIN_DIR
+exec "$CMDR_BIN_DIR/cmdr-node" hook "$@"

package/plugins/cmdr/bin/cmdr-mcp

@@ -0,0 +1,4 @@
+#!/bin/sh
+CMDR_BIN_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+export CMDR_BIN_DIR
+exec "$CMDR_BIN_DIR/cmdr-node" mcp "$@"

package/plugins/cmdr/bin/cmdr-node

@@ -0,0 +1,34 @@
+#!/bin/sh
+# All installed entry points are dependency-free; only Node >=22.5 is needed.
+CMDR_ENTRY=$1
+shift
+CMDR_RUNTIME_HOME=${CMDR_HOME:-"$HOME/.cmdr"}
+CMDR_NODE=''
+if [ -r "$CMDR_RUNTIME_HOME/node-path" ]; then
+  IFS= read -r CMDR_NODE < "$CMDR_RUNTIME_HOME/node-path"
+  [ -x "$CMDR_NODE" ] || CMDR_NODE=''
+fi
+if [ -z "$CMDR_NODE" ]; then
+  CMDR_PATH_NODE=$(command -v node 2>/dev/null || true)
+  for CMDR_CANDIDATE in "$CMDR_PATH_NODE" "$HOME"/.local/share/fnm/node-versions/*/installation/bin/node "$HOME"/Library/Application\ Support/fnm/node-versions/*/installation/bin/node "$HOME"/.nvm/versions/node/*/bin/node "$HOME"/.volta/bin/node "$HOME"/.local/share/mise/installs/node/*/bin/node /opt/homebrew/bin/node /usr/local/bin/node /usr/bin/node; do
+    [ -x "$CMDR_CANDIDATE" ] || continue
+    if "$CMDR_CANDIDATE" -e 'const [a,b]=process.versions.node.split(".").map(Number);process.exit(a>22||(a===22&&b>=5)?0:1)' >/dev/null 2>&1; then
+      CMDR_NODE=$CMDR_CANDIDATE
+      break
+    fi
+  done
+  if [ -n "$CMDR_NODE" ]; then
+    (umask 077; mkdir -p "$CMDR_RUNTIME_HOME" && printf '%s\n' "$CMDR_NODE" > "$CMDR_RUNTIME_HOME/node-path") 2>/dev/null || true
+  fi
+fi
+if [ -z "$CMDR_NODE" ]; then
+  [ "$CMDR_ENTRY" = hook ] && exit 0
+  echo 'cmdr requires Node.js >=22.5 (24 recommended). Install Node and retry.' >&2
+  exit 1
+fi
+if [ ! -f "$CMDR_BIN_DIR/../dist/$CMDR_ENTRY.mjs" ]; then
+  [ "$CMDR_ENTRY" = hook ] && exit 0
+  echo 'cmdr runtime is not built. Run npm ci && npm run build in the repository, or install the built npm package.' >&2
+  exit 1
+fi
+exec "$CMDR_NODE" --experimental-sqlite --disable-warning=ExperimentalWarning "$CMDR_BIN_DIR/../dist/$CMDR_ENTRY.mjs" "$@"

package/plugins/cmdr/commands/cmdr.md

@@ -0,0 +1,7 @@
+---
+description: Create or join a named local agent squad.
+argument-hint: <name>
+---
+Call the cmdr join tool with squad_name="$ARGUMENTS". This is an atomic find-or-create operation; do not list then create. If no name was provided, ask for one. Do not invent a name.
+If the squad is orphaned, ask whether to take over as commander or join as executor and then use explicit role and squad ID.
+Follow the returned protocol_hint. An executor reports ready with cwd, capabilities and context before replying. Translate user_reply into the user's language, keep the join line unchanged, and reply with only that text. Then use read(wait=me.recommended_wait) to participate.