flower-trellis 0.6.2 → 0.6.3

package/src/commands/plugin-remote.js

@@ -7,13 +7,17 @@ import {
   PluginRuntimeError,
 } from "../plugin/runtime-errors.js";
 import { parseCanonicalPluginId } from "../plugin/schemas/shared.js";
+import { GITLAB_OAUTH_REQUEST_SCOPES } from "../plugin/auth/credential-store.js";
+import { GitLabCredentialResolver } from "../plugin/auth/gitlab-credential-resolver.js";
 import { createCredentialStore } from "../plugin/auth/keyring-credential-store.js";
 import { GitLabCredentialManager, GitLabOAuthClient } from "../plugin/auth/gitlab-oauth.js";
 import { GitLabRestClient } from "../plugin/gitlab/rest-client.js";
 import { GitHubRestClient } from "../plugin/github/rest-client.js";
 import { GitLabSourceProvider } from "../plugin/sources/gitlab-provider.js";
 import { GitHubSourceProvider } from "../plugin/sources/github-provider.js";
+import { SourceRegistry } from "../plugin/sources/source-registry.js";
 import { UserSourceStore } from "../plugin/sources/user-source-store.js";
+import { listContentSkillChoices } from "../plugin/content-selection.js";
 import { compareUtf8 } from "../plugin/stable-order.js";
 
 /**
@@ -53,8 +57,9 @@ function printManagementResult(result, json, output) {
     return;
   }
   if (result.subcommand === "status") {
+    const scopeSuffix = result.scopes?.length ? `，scope=${result.scopes.join(",")}` : "";
     output.log(result.authorized
-      ? `GitLab 已登录:${result.sourceId}，scope=${result.scopes.join(",")}`
+      ? `GitLab 已登录:${result.sourceId}${scopeSuffix}`
       : `GitLab 未登录:${result.sourceId}`);
   } else output.log(`GitLab auth ${result.subcommand} 完成:${result.sourceId}`);
   if (result.persistent === false) output.log("系统 Keyring 不可用，凭据仅在当前进程内有效");
@@ -134,16 +139,23 @@ export async function getPluginAuthStatus(sourceId, options = {}) {
     };
   }
   const credentialBundle = options.credentialBundle || await createCredentialStore(options.credentialStoreOptions);
-  const credential = await credentialBundle.store.get(source);
+  const resolver = options.credentialResolver || new GitLabCredentialResolver({
+    store: credentialBundle.store,
+    persistent: credentialBundle.persistent,
+    env: options.env,
+    runGlab: options.runGlab,
+    glabCommand: options.glabCommand,
+  });
+  const status = await resolver.status(source);
   return {
     ok: true,
     command: "auth",
     subcommand: "status",
     sourceId: source.id,
-    authorized: Boolean(credential),
-    scopes: credential?.scope || [],
-    expiresAt: credential?.expiresAt || null,
-    persistent: credentialBundle.persistent,
+    authorized: status.authorized,
+    scopes: status.scopes,
+    expiresAt: status.expiresAt,
+    persistent: status.persistent,
   };
 }
 
@@ -167,7 +179,16 @@ export async function searchPluginMarketplaces(parsed, ctx, options = {}) {
       sleep: options.sleep,
       now: options.now,
     });
-    manager = new GitLabCredentialManager({ store: credentialBundle.store, oauth, now: options.now });
+    manager = new GitLabCredentialManager({
+      store: credentialBundle.store,
+      oauth,
+      now: options.now,
+      persistent: credentialBundle.persistent,
+      credentialResolver: options.credentialResolver,
+      env: options.env,
+      runGlab: options.runGlab,
+      glabCommand: options.glabCommand,
+    });
   }
   const results = [];
   const diagnostics = [];
@@ -193,6 +214,122 @@ export async function searchPluginMarketplaces(parsed, ctx, options = {}) {
   };
 }
 
+/**
+ * 为 TUI 按需读取 Marketplace Plugin 的 manifest Skill 清单。
+ *
+ * @param {{pluginId:string,version?:string,source?:string|null,lockedPlugin?:import("../plugin/contracts.js").ResolvedPlugin|null}} request 读取请求
+ * @param {object} ctx CLI 上下文
+ * @param {object} [options] Provider、凭据和测试注入
+ * @returns {Promise<{ok:true,pluginId:string,version:string,name:string,skills:Array<{name:string,path:string,description?:string,version?:string}>}>} Skill 清单
+ */
+export async function inspectPluginContentSkills(request, ctx, options = {}) {
+  const canonicalId = request.pluginId || request.lockedPlugin?.id;
+  if (!canonicalId) {
+    throw new PluginRuntimeError("读取 Plugin Skill 清单需要 Plugin ID", {
+      code: PLUGIN_RUNTIME_ERROR_CODES.USAGE_ERROR,
+      path: "pluginId",
+    });
+  }
+  const registry = new SourceRegistry(options.providers || []);
+  const lock = request.lockedPlugin
+    ? { schemaVersion: 1, roots: [request.lockedPlugin.id], plugins: [request.lockedPlugin] }
+    : null;
+  const parsed = request.lockedPlugin
+    ? { command: "verify", pluginId: canonicalId, source: null }
+    : { command: "add", pluginId: canonicalId, source: request.source || null };
+
+  await registerRemotePluginSources({
+    parsed,
+    projectRoot: ctx.target,
+    options,
+    registry,
+    lock,
+  });
+  const manifestInspection = await inspectRemotePluginContentManifest({
+    canonicalId,
+    registry,
+    version: request.version,
+    lockedPlugin: request.lockedPlugin || null,
+  });
+  if (manifestInspection) {
+    return {
+      ok: true,
+      pluginId: canonicalId,
+      version: manifestInspection.version,
+      name: manifestInspection.manifest.name,
+      skills: listContentSkillChoices(manifestInspection.manifest.content.skills || [], canonicalId),
+    };
+  }
+  await prepareRemotePluginForSkillInspection({
+    parsed,
+    canonicalId,
+    registry,
+    lock,
+    version: request.version,
+  });
+
+  let plugin = request.lockedPlugin || null;
+  if (!plugin) {
+    const candidates = registry.listCandidates(canonicalId);
+    plugin = candidates.find((candidate) => candidate.version === request.version) || null;
+    if (!plugin) {
+      throw new PluginRuntimeError(`Marketplace Plugin 版本不存在:${canonicalId}@${request.version}`, {
+        code: PLUGIN_RUNTIME_ERROR_CODES.SOURCE_NOT_FOUND,
+        path: canonicalId,
+      });
+    }
+  }
+
+  const pluginPackage = registry.readPackage(plugin);
+  return {
+    ok: true,
+    pluginId: canonicalId,
+    version: plugin.version,
+    name: pluginPackage.manifest.name,
+    skills: listContentSkillChoices(pluginPackage.manifest.content.skills || [], canonicalId),
+  };
+}
+
+/**
+ * 优先用 Provider 的 manifest-only inspection 读取 Skill 清单元数据。
+ *
+ * 这里不需要运行时包内容，也不需要 canonical tree hash；完整安装/更新仍会在生命周期
+ * 中准备固定包并校验摘要。TUI 首屏只展示 manifest 声明，避免为 checkbox 下载 archive。
+ *
+ * @param {{canonicalId:string,registry:object,version?:string|null,lockedPlugin?:object|null}} context 读取上下文
+ * @returns {Promise<{version:string,manifest:import("../plugin/contracts.js").PluginManifest}|null>} manifest inspection 结果
+ */
+async function inspectRemotePluginContentManifest({ canonicalId, registry, version, lockedPlugin }) {
+  const { sourceId } = parseCanonicalPluginId(canonicalId);
+  if (!registry.has(sourceId)) return null;
+  const provider = registry.get(sourceId);
+  if (typeof provider.inspectContentManifest !== "function") return null;
+  return provider.inspectContentManifest(canonicalId, { version, lockedPlugin });
+}
+
+/**
+ * 为 TUI Skill inspection 准备远程包。
+ *
+ * inspection 只需要读取用户当前选择的一个包版本；Provider 支持单版本准备时不走完整依赖闭包，
+ * 避免为了展示 checkbox 下载同一 Plugin 的全部历史版本。
+ *
+ * @param {{parsed:object,canonicalId:string,registry:object,lock:object|null,version?:string|null}} context 准备上下文
+ * @returns {Promise<void>} 准备完成
+ */
+async function prepareRemotePluginForSkillInspection({ parsed, canonicalId, registry, lock, version }) {
+  if (lock) {
+    await prepareRemotePluginCandidates({ parsed, canonicalId, registry, lock });
+    return;
+  }
+  const { sourceId } = parseCanonicalPluginId(canonicalId);
+  const provider = registry.has(sourceId) ? registry.get(sourceId) : null;
+  if (version && typeof provider?.prepareVersion === "function") {
+    await provider.prepareVersion(canonicalId, version);
+    return;
+  }
+  await prepareRemotePluginCandidates({ parsed, canonicalId, registry, lock });
+}
+
 /**
  * 探测 GitHub 来源并返回可持久化 descriptor 与兼容性结果。
  *
@@ -309,10 +446,10 @@ export async function runPluginManagementCommand(parsed, ctx, options, output) {
         baseUrl: parsed.baseUrl || base.baseUrl,
         project: parsed.project || base.project,
         ref: parsed.ref || base.ref || "main",
-        marketplacePath: parsed.marketplacePath || base.marketplacePath || ".flower-marketplace/marketplace.json",
+        marketplacePath: parsed.marketplacePath || base.marketplacePath || ".flower-plugin/marketplace.json",
         oauth: {
           applicationId: parsed.applicationId || base.oauth?.applicationId,
-          scopes: ["read_api", "read_repository"],
+          scopes: GITLAB_OAUTH_REQUEST_SCOPES,
         },
       };
       if (sourceType === "github") {
@@ -470,7 +607,16 @@ export async function registerRemotePluginSources({ parsed, projectRoot, options
       sleep: options.sleep,
       now: options.now,
     });
-    manager = new GitLabCredentialManager({ store: credentialBundle.store, oauth, now: options.now });
+    manager = new GitLabCredentialManager({
+      store: credentialBundle.store,
+      oauth,
+      now: options.now,
+      persistent: credentialBundle.persistent,
+      credentialResolver: options.credentialResolver,
+      env: options.env,
+      runGlab: options.runGlab,
+      glabCommand: options.glabCommand,
+    });
   }
   // 依赖闭包可能跨 source，因此登记全部可用来源，而不是只登记入口来源。
   for (const source of sources) {

package/src/commands/plugin.js

@@ -17,6 +17,7 @@ import {
   SKILL_GARDEN_PLUGIN_ID,
   SkillGardenBuiltinProvider,
 } from "../builtin-plugins/skill-garden/provider.js";
+import { contentSelectionFromSkillNames } from "../plugin/content-selection.js";
 
 const REMOTE_PLUGIN_ENTRY = new URL("./plugin-remote.js", import.meta.url);
 const PATCH_RUNTIME_ENTRY = new URL("../plugin/install/patch-planner.js", import.meta.url);
@@ -35,6 +36,7 @@ const PLUGIN_CONFLICT_CODES = new Set([
   PLUGIN_RUNTIME_ERROR_CODES.DEPENDENCY_MISSING,
   PLUGIN_RUNTIME_ERROR_CODES.DEPENDENCY_CONFLICT,
   PLUGIN_RUNTIME_ERROR_CODES.DEPENDENCY_CYCLE,
+  PLUGIN_RUNTIME_ERROR_CODES.CONTENT_SELECTION_INVALID,
   PLUGIN_RUNTIME_ERROR_CODES.CONTENT_CONFLICT,
   PLUGIN_RUNTIME_ERROR_CODES.TARGET_DRIFT,
   PLUGIN_RUNTIME_ERROR_CODES.VERIFY_FAILED,
@@ -227,7 +229,7 @@ function parseManagementArgs(argv) {
  * 解析 Plugin 多级命令参数。
  *
  * @param {string[]} argv `plugin` 后的参数
- * @returns {{command:string,pluginId:string|null,source:string|null,version:string|null,platforms:string[],dryRun:boolean,json:boolean,help:boolean}} 解析结果
+ * @returns {{command:string,pluginId:string|null,source:string|null,version:string|null,platforms:string[],contentSelection:object|null,dryRun:boolean,json:boolean,help:boolean}} 解析结果
  */
 export function parsePluginArgs(argv) {
   const authoring = parsePluginAuthoringArgs(argv);
@@ -238,6 +240,7 @@ export function parsePluginArgs(argv) {
   const command = rootHelp ? "list" : (argv[0] || "list");
   const positional = [];
   const platforms = [];
+  const contentSkills = [];
   const widen = [];
   let source = null;
   let version = null;
@@ -247,7 +250,13 @@ export function parsePluginArgs(argv) {
 
   for (let index = 1; index < argv.length; index += 1) {
     const token = argv[index];
-    if (token === "--source" || token === "--version" || token === "--platform" || token === "--widen") {
+    if (
+      token === "--source" ||
+      token === "--version" ||
+      token === "--platform" ||
+      token === "--widen" ||
+      token === "--content-skill"
+    ) {
       const value = argv[index + 1];
       if (!value || value.startsWith("--")) {
         throw new PluginRuntimeError(`${token} 缺少取值`, {
@@ -259,6 +268,7 @@ export function parsePluginArgs(argv) {
       if (token === "--source") source = value;
       else if (token === "--version") version = value;
       else if (token === "--widen") widen.push(value);
+      else if (token === "--content-skill") contentSkills.push(value);
       else platforms.push(value);
       continue;
     }
@@ -341,6 +351,24 @@ export function parsePluginArgs(argv) {
       path: command,
     });
   }
+  const contentSelection = contentSkills.length > 0
+    ? contentSelectionFromSkillNames(contentSkills, {
+      code: PLUGIN_RUNTIME_ERROR_CODES.USAGE_ERROR,
+      path: "--content-skill",
+    })
+    : null;
+  if (contentSelection && !["add", "update"].includes(command)) {
+    throw new PluginRuntimeError("--content-skill 仅支持 plugin add 与单个 plugin update", {
+      code: PLUGIN_RUNTIME_ERROR_CODES.USAGE_ERROR,
+      path: command,
+    });
+  }
+  if (contentSelection && command === "update" && (!positional[0] || widen.length > 0)) {
+    throw new PluginRuntimeError("--content-skill 仅支持单个 plugin update，且不能与 --widen 同时使用", {
+      code: PLUGIN_RUNTIME_ERROR_CODES.USAGE_ERROR,
+      path: "--content-skill",
+    });
+  }
   return {
     command,
     pluginId: positional[0] || null,
@@ -348,6 +376,7 @@ export function parsePluginArgs(argv) {
     version,
     widen: parseWidenPairs(widen),
     platforms: parsePlatforms(platforms),
+    contentSelection,
     dryRun,
     json,
     help,
@@ -365,8 +394,8 @@ function printPluginHelp(output) {
     : "";
   output.log(`用法:
   flower-trellis plugin list [--json]
-  flower-trellis plugin add <plugin> [--source <来源 ID|项目内路径>] [--version <range>] [--platform <id>] [--dry-run] [--json]
-  flower-trellis plugin update [plugin] [--version <range>] [--widen <plugin>=<range>]... [--platform <id>] [--dry-run] [--json]
+  flower-trellis plugin add <plugin> [--source <来源 ID|项目内路径>] [--version <range>] [--platform <id>] [--content-skill <name>]... [--dry-run] [--json]
+  flower-trellis plugin update [plugin] [--version <range>] [--widen <plugin>=<range>]... [--platform <id>] [--content-skill <name>]... [--dry-run] [--json]
   flower-trellis plugin remove <plugin> [--dry-run] [--json]
   flower-trellis plugin verify [plugin] [--json]
   flower-trellis plugin init --id <source/plugin> --name <name> [--version <semver>] [--profile <standard|integration>] [--patches] [--marketplace] [--non-interactive] [--json]
@@ -875,6 +904,7 @@ export async function plugin(ctx, options = {}) {
             : "*"
         ),
         platforms: parsed.platforms,
+        ...(parsed.contentSelection ? { contentSelection: parsed.contentSelection } : {}),
         dryRun: parsed.dryRun,
         onPreflight: options.onPreflight,
       };
@@ -893,6 +923,7 @@ export async function plugin(ctx, options = {}) {
           : parsed.version ? { version: parsed.version } : {}),
         ...(Object.keys(parsed.widen || {}).length > 0 ? { widen: parsed.widen } : {}),
         platforms: parsed.platforms,
+        ...(parsed.contentSelection ? { contentSelection: parsed.contentSelection } : {}),
         dryRun: parsed.dryRun,
         onPreflight: options.onPreflight,
       };

package/src/lib/skill-catalog.js

@@ -444,6 +444,16 @@ function isCommonSkillInstalled(target, name) {
   );
 }
 
+/**
+ * 判断目标是否已经初始化为 Trellis 项目。
+ *
+ * @param {string} target 目标项目根目录
+ * @returns {boolean} 是否存在 `.trellis` 入口
+ */
+function hasTrellisProject(target) {
+  return fs.existsSync(path.join(target, ".trellis"));
+}
+
 /**
  * 读取当前可管理的通用技能元数据。
  *
@@ -502,6 +512,15 @@ function listWorkflowEnhancementSkills(target, variantDir) {
  * @returns {{variant: string, version: string, commonSkills: object[], enhancementSkills: object[]}} 菜单清单
  */
 export function listSkillCatalog(target, variantOverride) {
+  if (!hasTrellisProject(target)) {
+    return {
+      variant: variantOverride || "common",
+      version: "",
+      commonSkills: listCommonSkills(target),
+      enhancementSkills: [],
+    };
+  }
+
   const { variant, version, variantDir } = resolveEnhancementSnapshot(
     target,
     variantOverride,
@@ -625,7 +644,7 @@ export function syncInstalledCommonSkills(target) {
  * @returns {{removed: string[], skipped: string[]}} 已删除与未发现的路径
  */
 export function removeCommonSkills(target, variantOverride, names) {
-  resolveEnhancementSnapshot(target, variantOverride);
+  if (hasTrellisProject(target)) resolveEnhancementSnapshot(target, variantOverride);
   const available = new Set(listCommonSnapshotNames());
   const removed = [];
   const skipped = [];

package/src/plugin/application-service.js

@@ -16,6 +16,11 @@ import { hashDirectoryIfExists, hashFileIfExists } from "./install/content-hash.
 import { getPluginPatchPlanner } from "./runtime-extensions.js";
 import { isRuntimeBuiltinProviderTrusted } from "./runtime-extensions.js";
 import { compareUtf8 } from "./stable-order.js";
+import {
+  contentSelectionsEqual,
+  normalizeContentSelection,
+  selectContentSkillEntries,
+} from "./content-selection.js";
 
 /**
  * 计算 lock roots 可达的全部 Plugin。
@@ -151,7 +156,7 @@ export class PluginApplicationService {
   /**
    * 添加或更新一个直接 Plugin 声明并应用完整图。
    *
-   * @param {{id:string,version?:string,platforms?:string[],dryRun?:boolean,approvals?:string[],approvedDigests?:Map<string,string>|Record<string,string>,nonInteractive?:boolean,onPreflight?:(result:object)=>void}} options 添加选项
+   * @param {{id:string,version?:string,platforms?:string[],contentSelection?:import("./contracts.js").PluginContentSelection,dryRun?:boolean,approvals?:string[],approvedDigests?:Map<string,string>|Record<string,string>,nonInteractive?:boolean,onPreflight?:(result:object)=>void}} options 添加选项
    * @returns {object} 生命周期结果
    */
   add(options) {
@@ -168,6 +173,11 @@ export class PluginApplicationService {
       source: sourceId,
       version: options.version || "*",
     };
+    const contentSelection = normalizeContentSelection(options.contentSelection, {
+      code: PLUGIN_RUNTIME_ERROR_CODES.USAGE_ERROR,
+      path: options.id,
+    });
+    if (contentSelection) declaration.contentSelection = contentSelection;
     const declarations = pluginsFile.plugins.filter(({ id }) => id !== options.id);
     declarations.push(declaration);
     return this.#applyLifecycle("add", {
@@ -189,12 +199,13 @@ export class PluginApplicationService {
    * 其锁定包也已不可重放，逐个更新会在其它节点上撞 `已锁定 Plugin 包不可重放`。
    * 传入 `widen` 时按 `update: "all"` 解析，让全部节点都允许升级，一次性解开这种死锁。
    *
-   * @param {{id?:string|null,version?:string,widen?:Map<string,string>|Record<string,string>,platforms?:string[],dryRun?:boolean,approvals?:string[],approvedDigests?:Map<string,string>|Record<string,string>,nonInteractive?:boolean,onPreflight?:(result:object)=>void}} [options] 更新选项
+   * @param {{id?:string|null,version?:string,widen?:Map<string,string>|Record<string,string>,contentSelection?:import("./contracts.js").PluginContentSelection|null,platforms?:string[],dryRun?:boolean,approvals?:string[],approvedDigests?:Map<string,string>|Record<string,string>,nonInteractive?:boolean,onPreflight?:(result:object)=>void}} [options] 更新选项
    * @returns {object} 生命周期结果
    */
   update(options = {}) {
     const pluginsFile = this.store.readPlugins();
     const widen = normalizeVersionOverrides(options.widen);
+    const hasContentSelection = Object.prototype.hasOwnProperty.call(options, "contentSelection");
     if (options.id && !pluginsFile.plugins.some(({ id }) => id === options.id)) {
       throw new PluginRuntimeError(`项目未声明 Plugin:${options.id}`, {
         code: PLUGIN_RUNTIME_ERROR_CODES.USAGE_ERROR,
@@ -214,6 +225,18 @@ export class PluginApplicationService {
         path: "widen",
       });
     }
+    if (hasContentSelection && !options.id) {
+      throw new PluginRuntimeError("更新 Content Skill 选择时必须指定 Plugin ID", {
+        code: PLUGIN_RUNTIME_ERROR_CODES.USAGE_ERROR,
+        path: "contentSelection",
+      });
+    }
+    if (hasContentSelection && widen.size > 0) {
+      throw new PluginRuntimeError("更新 Content Skill 选择时不能同时放宽声明范围", {
+        code: PLUGIN_RUNTIME_ERROR_CODES.USAGE_ERROR,
+        path: "contentSelection",
+      });
+    }
     const declaredIds = new Set(pluginsFile.plugins.map(({ id }) => id));
     for (const id of [...widen.keys()].sort(compareUtf8)) {
       if (!declaredIds.has(id)) {
@@ -229,12 +252,24 @@ export class PluginApplicationService {
     const overrides = options.version && options.id
       ? new Map([[options.id, options.version]])
       : widen;
-    const nextPlugins = overrides.size > 0
+    const contentSelection = hasContentSelection
+      ? normalizeContentSelection(options.contentSelection, {
+        code: PLUGIN_RUNTIME_ERROR_CODES.USAGE_ERROR,
+        path: options.id,
+      })
+      : undefined;
+    const nextPlugins = (overrides.size > 0 || hasContentSelection)
       ? {
         ...pluginsFile,
-        plugins: pluginsFile.plugins.map((plugin) => (
-          overrides.has(plugin.id) ? { ...plugin, version: overrides.get(plugin.id) } : plugin
-        )),
+        plugins: pluginsFile.plugins.map((plugin) => {
+          let next = overrides.has(plugin.id) ? { ...plugin, version: overrides.get(plugin.id) } : plugin;
+          if (hasContentSelection && plugin.id === options.id) {
+            next = { ...next };
+            if (contentSelection) next.contentSelection = contentSelection;
+            else delete next.contentSelection;
+          }
+          return next;
+        }),
       }
       : pluginsFile;
     return this.#applyLifecycle("update", {
@@ -410,13 +445,32 @@ export class PluginApplicationService {
           severity: "error",
         });
       }
+      const locked = lockById.get(declaration.id);
+      const applied = stateById.get(declaration.id);
+      if (locked && !contentSelectionsEqual(declaration.contentSelection, locked.contentSelection)) {
+        diagnostics.push({
+          code: "verify.content-selection-lock-mismatch",
+          path: declaration.id,
+          message: `Plugin 声明与 lock 的 Content Skill 选择不一致:${declaration.id}`,
+          severity: "error",
+        });
+      }
+      if (applied && !contentSelectionsEqual(declaration.contentSelection, applied.contentSelection)) {
+        diagnostics.push({
+          code: "verify.content-selection-state-mismatch",
+          path: declaration.id,
+          message: `Plugin 声明与 state 的 Content Skill 选择不一致:${declaration.id}`,
+          severity: "error",
+        });
+      }
     }
     for (const id of requestedIds) {
       const locked = lockById.get(id);
       const applied = stateById.get(id);
       if (!locked) continue;
+      let pluginPackage = null;
       try {
-        this.registry.readPackage(locked);
+        pluginPackage = this.registry.readPackage(locked);
       } catch (error) {
         diagnostics.push({
           code: "verify.package-invalid",
@@ -425,6 +479,18 @@ export class PluginApplicationService {
           severity: "error",
         });
       }
+      if (pluginPackage) {
+        try {
+          selectContentSkillEntries(pluginPackage.manifest.content.skills || [], locked.contentSelection, id);
+        } catch (error) {
+          diagnostics.push({
+            code: "verify.content-selection-invalid",
+            path: id,
+            message: error.message,
+            severity: "error",
+          });
+        }
+      }
       if (!applied) {
         diagnostics.push({
           code: "verify.state-missing",
@@ -442,6 +508,14 @@ export class PluginApplicationService {
           severity: "error",
         });
       }
+      if (!contentSelectionsEqual(locked.contentSelection, applied.contentSelection)) {
+        diagnostics.push({
+          code: "verify.content-selection-apply-mismatch",
+          path: id,
+          message: `Plugin lock 与 state 的 Content Skill 选择不一致:${id}`,
+          severity: "error",
+        });
+      }
       for (const entry of applied.paths) {
         const target = path.join(this.projectRoot, ...entry.path.split("/"));
         let actual = null;

package/src/plugin/auth/credential-store.js

@@ -3,8 +3,20 @@ import { PLUGIN_RUNTIME_ERROR_CODES, PluginRuntimeError } from "../runtime-error
 /** 凭据载荷 schema 版本。 */
 export const CREDENTIAL_SCHEMA_VERSION = 1;
 
-/** Flower GitLab OAuth 固定 scope。 */
-export const GITLAB_OAUTH_SCOPES = Object.freeze(["read_api", "read_repository"]);
+/** Flower GitLab OAuth 主动请求 scope。 */
+export const GITLAB_OAUTH_REQUEST_SCOPES = Object.freeze([
+  "openid",
+  "profile",
+  "read_user",
+  "write_repository",
+  "api",
+]);
+
+/** 旧版 GitLab OAuth 读取能力 scope。 */
+export const GITLAB_OAUTH_LEGACY_SCOPES = Object.freeze(["read_api", "read_repository"]);
+
+/** 兼容旧内部导入名；新代码应使用 GITLAB_OAUTH_REQUEST_SCOPES。 */
+export const GITLAB_OAUTH_SCOPES = GITLAB_OAUTH_REQUEST_SCOPES;
 
 /**
  * 规范化 GitLab 来源凭据账户名。
@@ -18,6 +30,16 @@ export function credentialAccount(source) {
   return `${url.hostname.toLowerCase()}${port}/${source.id}`;
 }
 
+/**
+ * 判断 GitLab OAuth scope 是否具备当前 REST 读取能力。
+ *
+ * @param {string[]} scopes 实际授权 scope
+ * @returns {boolean} 是否满足读取 Marketplace 所需能力
+ */
+export function isGitLabCredentialScopeSufficient(scopes) {
+  return scopes.includes("api") || GITLAB_OAUTH_LEGACY_SCOPES.every((scope) => scopes.includes(scope));
+}
+
 /**
  * 校验并规范化版本化 OAuth 凭据。
  *
@@ -38,7 +60,7 @@ export function validateCredential(value, source) {
     typeof credential.accessToken !== "string" ||
     credential.accessToken.length === 0 ||
     typeof credential.tokenType !== "string" ||
-    !GITLAB_OAUTH_SCOPES.every((scope) => scopes.includes(scope)) ||
+    !isGitLabCredentialScopeSufficient(scopes) ||
     !(credential.refreshToken === null || typeof credential.refreshToken === "string") ||
     !(credential.createdAt === undefined || credential.createdAt === null || Number.isFinite(credential.createdAt)) ||
     !(credential.expiresAt === null || Number.isFinite(credential.expiresAt)) ||