flavor-code 1.2.18 → 1.3.0

package/README.md

@@ -33,8 +33,9 @@ Flavor Code connects to OpenAI, Anthropic, or compatible services and works with
 | --- | --- | --- |
 | 🖥️ | **One runtime, three entry points** | CLI, Electron, and VS Code share model configuration, sessions, and tooling |
 | 🧭 | **Controlled progress on complex tasks** | Task plans, sub-agents, steering, follow-ups, `/loop`, `/goal`, and conflict-safe parallel execution (tasks owning overlapping files run serially) |
-| ⏪ | **Traceable, resumable results** | Full timeline, checkpoints, rewind, traces, diffs, and failure audits |
-| 🧠 | **Local long-term context** | Memory, Skills, plugins, and project guides stored on your machine |
+| ⏪ | **Traceable, resumable results** | Full timeline, checkpoints, rewind, traces, diffs, and failure audits |
+| 🧱 | **Crash-consistent execution** | Fsync-backed event journal, durable steering queue, savepoints, and no automatic replay of non-idempotent tools |
+| 🧠 | **Local long-term context** | Memory, Skills, plugins, and project guides stored on your machine |
 | 🔎 | **Code graph navigation** | A local AST code-graph index (`.flavor/astgraph/`) powers `ast_search`/`ast_callers`/`ast_impact` queries for precise symbol lookup and reachability tracing |
 | 🌿 | **Git-native workflows** | `/commit` drafts a Conventional-Commits message for staged changes and commits after confirmation; `/review` audits uncommitted changes; the read-only `GitHistory` tool explains when and why code changed |
 | 🎨 | **E2E requirement-to-delivery** | From a rough requirement or a design export to a delivered product: PRD, interactive prototype, visual implementation, API integration, autonomous acceptance, and scored delivery (Electron only) |
@@ -247,12 +248,12 @@ flavor mcp disable docs
 
 </details>
 
-A Skill is a `SKILL.md` with YAML frontmatter, placed in `.flavor/skills/<name>/` or `~/.flavor-code/skills/<name>/`. Flavor loads skills progressively based on the task, and you can invoke one explicitly with `/<skill-name>`.
+A Skill is a `SKILL.md` with YAML frontmatter, placed in `.flavor/skills/<name>/` or `~/.flavor-code/skills/<name>/`. Flavor loads skills progressively based on the task, and you can invoke one explicitly with `/<skill-name>`. Skill bodies support `$ARGUMENTS`, `$ARGUMENTS[N]`, and `$N` substitutions. A running composite Skill can load a dependency through the read-only `Skill` tool; plugin-qualified names such as `superharness:test-driven-development` resolve to discovered skills.
 
-Plugins live in `.flavor/plugins/` and can register commands, tools, hooks, Skill roots, and model adapters.
-
-> [!WARNING]
-> Plugins and agent self-registered tools are in-process JavaScript, not a security sandbox. Only install, enable, and approve code you trust.
+Plugins live in `.flavor/plugins/` and can register commands, tools, hooks, Skill roots, and model adapters. `additionalContext` returned by `SessionStart` and `UserPromptSubmit` hooks is added to the current task context, enabling reliable project-level engineering policy injection. Production plugin activation is isolated in a Worker/vm realm by default and records a content fingerprint plus declared capabilities.
+
+> [!WARNING]
+> Sandboxing reduces ambient access but does not make untrusted instructions safe. Only install and enable plugins you trust; legacy `pluginSandbox: false` activation grants full in-process Node.js access.
 
 ## Sessions, Memory & Execution Records
 
@@ -261,7 +262,8 @@ Project runtime data lives under `.flavor/`:
 ```text
 .flavor/
 ├── flavor.json       # Project config
-├── sessions/         # Session timelines
+├── sessions/         # Session timelines
+│   └── *.events.jsonl # Crash-consistent execution journals
 ├── session-assets/   # Image attachments
 ├── session-trees/    # Session branches
 ├── checkpoints/      # Workspace snapshots
@@ -286,7 +288,9 @@ Image prompts support PNG, JPEG, and WebP, with a 5 MiB per-image maximum and up
 | `plan` | Read-only planning; no modifications or execution |
 | `bypassPermissions` | The main agent executes as much as possible after hard safety checks |
 | `auto` | A classifier decides, falling back to human approval when uncertain |
-| `bubble` | Uncertain operations bubble up to the main session for approval |
+| `bubble` | Uncertain operations bubble up to the main session for approval |
+
+Layered permission policies can be defined in the managed, user, project, local-project, and session tiers. Matching rules use token arrays and the strictest result always wins (`deny > ask > allow`); built-in hard denials cannot be weakened.
 
 > [!CAUTION]
 > Local Shell still runs as your current user. Consider enabling Docker when working with untrusted projects.
@@ -376,7 +380,8 @@ npm run build
 ## Documentation
 
 - [Technical Design Report](./技术方案报告.md): overall architecture, agent loop, context, permissions, plugins, and security model
-- [Runtime reliability spec](./docs/specs/2026-07-26-runtime-reliability.md)
+- [Runtime reliability spec](./docs/specs/2026-07-26-runtime-reliability.md)
+- [1.3 reliability, prompt-cache & verification contract](./docs/specs/2026-08-24-v1.3-reliability-contract.md)
 - [Control plane, sandbox & VS Code spec](./docs/specs/2026-07-29-control-plane-sandbox-vscode.md)
 - [Multimodal image attachments spec](./docs/specs/2026-07-30-multimodal-image-attachments.md)
 - [D2C design-to-code spec](./docs/specs/2026-08-09-d2c-design-to-code.md)
@@ -390,7 +395,7 @@ npm run build
 - Review model-generated code and commands, especially dependency installs, scripts, and deletions.
 - Do not treat `.flavor/sessions/`, traces, or long-term memory as secret stores.
 - Use least-privilege API keys and never commit `.env`.
-- Skill content can influence model behavior; plugins and self-registered tools also have in-process Node.js permissions.
+- Skill content can influence model behavior; sandboxed plugins still require review, while explicitly enabled legacy in-process plugins have full Node.js permissions.
 - Work under version control and create checkpoints before high-risk tasks.
 
 ## Contributing

package/README.zh-CN.md

@@ -33,8 +33,9 @@ Flavor Code 接入 OpenAI、Anthropic 或兼容服务，在受控工作区内使
 | --- | --- | --- |
 | 🖥️ | **一个运行时，三个入口** | CLI、Electron 与 VS Code 共享模型配置、会话和工具能力 |
 | 🧭 | **复杂任务可控推进** | 任务计划、子 Agent、steering、follow-up、`/loop`、`/goal`，并行任务自动避免写冲突（拥有重叠文件的任务串行执行） |
-| ⏪ | **结果可追溯、可恢复** | 完整时间线、checkpoint、rewind、trace、Diff 和失败审计 |
-| 🧠 | **本地长期上下文** | 记忆、Skill、插件和项目指南均保存在本机 |
+| ⏪ | **结果可追溯、可恢复** | 完整时间线、checkpoint、rewind、trace、Diff 和失败审计 |
+| 🧱 | **崩溃一致执行** | fsync 事件日志、持久 steering 队列、savepoint，非幂等工具不自动重放 |
+| 🧠 | **本地长期上下文** | 记忆、Skill、插件和项目指南均保存在本机 |
 | 🔎 | **代码图导航** | 本地 AST 代码图索引（`.flavor/astgraph/`），通过 `ast_search`/`ast_callers`/`ast_impact` 等查询精确定位符号、追踪可达性 |
 | 🌿 | **Git 原生工作流** | `/commit` 为暂存改动生成 Conventional Commits 提交信息并确认提交；`/review` 审查未提交改动；只读 `GitHistory` 工具回答“这段代码为什么是这样” |
 | 🎨 | **E2E 需求到交付** | 从粗需求或设计稿到可交付产品：PRD、交互原型、视觉还原、接口联调、自主验收与评分交付（仅 Electron） |
@@ -247,12 +248,12 @@ flavor mcp disable docs
 
 </details>
 
-Skill 是带有 YAML 头信息的 `SKILL.md`，放在 `.flavor/skills/<name>/` 或 `~/.flavor-code/skills/<name>/`。Flavor 会按任务渐进加载，也支持通过 `/<skill-name>` 显式调用。
+Skill 是带有 YAML 头信息的 `SKILL.md`，放在 `.flavor/skills/<name>/` 或 `~/.flavor-code/skills/<name>/`。Flavor 会按任务渐进加载，也支持通过 `/<skill-name>` 显式调用。Skill 正文支持 `$ARGUMENTS`、`$ARGUMENTS[N]` 和 `$N` 参数占位符；运行中的组合 Skill 可以使用只读 `Skill` 工具继续加载依赖 Skill，插件限定名称（如 `superharness:test-driven-development`）会安全解析到已发现的 Skill。
 
-插件放在 `.flavor/plugins/`，可以注册命令、工具、Hook、Skill 根目录和模型适配器。
-
-> [!WARNING]
-> 插件和 Agent 自注册工具是进程内执行的 JavaScript，不是安全沙箱。只安装、启用和批准你信任的代码。
+插件放在 `.flavor/plugins/`，可以注册命令、工具、Hook、Skill 根目录和模型适配器。`SessionStart` 与 `UserPromptSubmit` Hook 返回的 `additionalContext` 会进入当前任务上下文，可用于注入项目级工程规则。产品运行时默认在 Worker/vm 隔离环境激活插件，并记录内容指纹与声明的能力。
+
+> [!WARNING]
+> 沙箱会降低环境权限，但不能让不可信指令自动变安全。只安装和启用可信插件；旧版兼容选项 `pluginSandbox: false` 会授予完整的进程内 Node.js 权限。
 
 ## 会话、记忆与执行记录
 
@@ -261,7 +262,8 @@ Skill 是带有 YAML 头信息的 `SKILL.md`，放在 `.flavor/skills/<name>/`
 ```text
 .flavor/
 ├── flavor.json       # 项目配置
-├── sessions/         # 会话时间线
+├── sessions/         # 会话时间线
+│   └── *.events.jsonl # 崩溃一致执行事件日志
 ├── session-assets/   # 图片附件
 ├── session-trees/    # 会话分支
 ├── checkpoints/      # 工作区快照
@@ -286,7 +288,9 @@ Skill 是带有 YAML 头信息的 `SKILL.md`，放在 `.flavor/skills/<name>/`
 | `plan` | 只读规划，不允许修改和执行 |
 | `bypassPermissions` | 主 Agent 在硬安全检查后尽量自动执行 |
 | `auto` | 使用分类器判断，无法确定时回到人工确认 |
-| `bubble` | 将不确定操作冒泡给主会话审批 |
+| `bubble` | 将不确定操作冒泡给主会话审批 |
+
+权限策略支持托管、用户、项目、本机项目和 session 五层配置。规则以 token 数组匹配，所有命中项始终采用最严格结果（`deny > ask > allow`），内置硬拒绝不可被放宽。
 
 > [!CAUTION]
 > 本地 Shell 仍然以当前用户身份运行。处理不可信项目时建议启用 Docker。
@@ -376,7 +380,8 @@ npm run build
 ## 文档
 
 - [技术方案报告](./技术方案报告.md)：整体架构、Agent 循环、上下文、权限、插件和安全模型
-- [运行时可靠性规范](./docs/specs/2026-07-26-runtime-reliability.md)
+- [运行时可靠性规范](./docs/specs/2026-07-26-runtime-reliability.md)
+- [1.3 可靠性、Prompt Cache 与验收契约](./docs/specs/2026-08-24-v1.3-reliability-contract.md)
 - [控制面、沙箱与 VS Code 规范](./docs/specs/2026-07-29-control-plane-sandbox-vscode.md)
 - [多模态图片规范](./docs/specs/2026-07-30-multimodal-image-attachments.md)
 - [VS Code 后续规划](./docs/specs/2026-08-01-flavor-code-vscode-next.md)
@@ -387,7 +392,7 @@ npm run build
 - 审查模型生成的代码和命令，尤其是依赖安装、脚本和删除操作。
 - 不要把 `.flavor/sessions/`、trace 或长期记忆当作秘密仓库。
 - 使用最小权限 API Key，不要提交 `.env`。
-- Skill 内容可能影响模型行为；插件和自注册工具还拥有进程内 Node.js 权限。
+- Skill 内容可能影响模型行为；沙箱插件仍需审查，显式启用的旧版进程内插件拥有完整 Node.js 权限。
 - 建议在版本控制下工作，并在高风险任务前创建 checkpoint。
 
 ## 参与贡献

package/dist/agent/loop.d.ts

@@ -2,7 +2,7 @@ import type { ContextManager } from "../context/manager.js";
 import type { HallucinationGuard } from "../hallucination/guard.js";
 import type { HookBus } from "../hooks/bus.js";
 import type { ModelRegistry } from "../models/registry.js";
-import { type ModelTool } from "../models/types.js";
+import { type ModelMessage, type ModelTool } from "../models/types.js";
 import type { ToolRuntime } from "../tools/runtime.js";
 import type { AgentEvent, AgentRunRequest } from "./types.js";
 export interface AgentLoopOptions {
@@ -21,6 +21,16 @@ export interface AgentLoopOptions {
     agent?: "main" | "subagent";
     ownerId?: string;
     hallucinationGuard?: HallucinationGuard;
+    modelJournal?: {
+        start(input: {
+            agent: "main" | "subagent";
+            model: string;
+            iteration: number;
+            attempt: number;
+            messages: readonly ModelMessage[];
+        }): string;
+        complete(id: string, completed: boolean, error?: string): void;
+    };
 }
 export declare class AgentLoop {
     #private;

package/dist/{app-YE3I7JMR.js → app-FOPTLLK5.js}

@@ -16,7 +16,7 @@ import {
   redactErrorText,
   transcriptReducer,
   withTimeout
-} from "./chunk-STZQ3Y3P.js";
+} from "./chunk-KL4UHJ2Q.js";
 import "./chunk-IG4Z23CL.js";
 import {
   Box_default,

package/dist/{chunk-JB57IX2A.js → chunk-IX65GYUF.js}

@@ -4,7 +4,7 @@ import {
   message,
   redactErrorText,
   redactSecrets
-} from "./chunk-STZQ3Y3P.js";
+} from "./chunk-KL4UHJ2Q.js";
 
 // src/rpc/server.ts
 import { createInterface } from "readline";