ostacky 0.7.3 → 0.8.0

package/dist/cli.js

@@ -20,12 +20,14 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -48,7 +50,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // node_modules/sisteransi/src/index.js
-var require_src = __commonJS((exports, module) => {
+var require_src = __commonJS(function(exports, module) {
   var ESC = "\x1B";
   var CSI = `${ESC}[`;
   var beep = "\x07";
@@ -106,7 +108,7 @@ var require_src = __commonJS((exports, module) => {
 });
 
 // node_modules/picocolors/picocolors.js
-var require_picocolors = __commonJS((exports, module) => {
+var require_picocolors = __commonJS(function(exports, module) {
   var p = process || {};
   var argv = p.argv || [];
   var env = p.env || {};
@@ -178,9 +180,14 @@ var require_picocolors = __commonJS((exports, module) => {
 // src/security.ts
 var exports_security = {};
 __export(exports_security, {
-  verifyChecksum: () => verifyChecksum,
+  BASH_SENSITIVE_RE: () => BASH_SENSITIVE_RE,
+  SENSITIVE_DEFAULT: () => SENSITIVE_DEFAULT,
+  extractPathsFromBash: () => extractPathsFromBash,
+  getSensitivePatterns: () => getSensitivePatterns,
+  isSensitive: () => isSensitive,
+  sha256: () => sha256,
   validateFilePath: () => validateFilePath,
-  sha256: () => sha256
+  verifyChecksum: () => verifyChecksum
 });
 import { createHash } from "crypto";
 function validateFilePath(filePath) {
@@ -201,9 +208,121 @@ function verifyChecksum(content, expectedHash, label) {
   recibido: ${actual}`);
   }
 }
-var init_security = () => {};
+function isSensitive(filePath, patterns = SENSITIVE_DEFAULT) {
+  if (!filePath)
+    return false;
+  const normalized = filePath.replace(/\\/g, "/");
+  const lower = normalized.toLowerCase();
+  if (lower.endsWith(".env.example") || lower.endsWith(".env.template") || lower.endsWith(".env.sample"))
+    return false;
+  const base = lower.split("/").pop() || "";
+  for (const pat of patterns) {
+    if (pat.includes(".env") && base.startsWith(".env"))
+      return true;
+    if (pat.includes(".secrets") && lower.includes(".secrets"))
+      return true;
+    if (pat.includes("*.pem") && lower.endsWith(".pem"))
+      return true;
+    if (pat.includes("*.key") && lower.endsWith(".key"))
+      return true;
+    if (pat.includes(".aws") && lower.includes(".aws"))
+      return true;
+    if (pat.includes(".ssh") && lower.includes(".ssh"))
+      return true;
+    if (pat.includes("credentials.json") && lower.endsWith("credentials.json"))
+      return true;
+    if (pat.includes(".npmrc") && lower.endsWith(".npmrc"))
+      return true;
+  }
+  if (/\.(pem|key)$/i.test(normalized))
+    return true;
+  if (base.startsWith(".env"))
+    return true;
+  return false;
+}
+function extractPathsFromBash(cmd) {
+  if (!cmd)
+    return [];
+  const normalized = cmd.replace(/&&/g, ";").replace(/\|\|/g, ";");
+  const segments = normalized.split(/[|;><\n]+/);
+  const paths = [];
+  for (const seg of segments) {
+    const trimmed = seg.trim();
+    if (!trimmed)
+      continue;
+    const tokens = trimmed.match(/(?:[^\s"'`\\]+|"[^"]*"|'[^']*'|`[^`]*`)+/g) || [];
+    for (let token of tokens) {
+      const stripped = token.replace(/["'`]/g, "").replace(/\\/g, "");
+      if (!stripped)
+        continue;
+      if (["cat", "grep", "ls", "echo", "awk", "sed", "cut", "head", "tail", "wc", "find", "xargs", "bash", "sh", "zsh", "env", "printenv", "node", "bun", "npm", "npx", "ls"].includes(stripped))
+        continue;
+      if (stripped.startsWith("-"))
+        continue;
+      const lower = stripped.toLowerCase();
+      if (stripped.includes("/") || stripped.includes(".") || lower.startsWith(".env") || lower.includes(".secrets") || lower.endsWith(".pem") || lower.endsWith(".key") || lower.includes(".aws") || lower.includes(".ssh") || lower.endsWith("credentials.json") || lower.endsWith(".npmrc")) {
+        const cleaned = stripped.replace(/[,:;)\]]+$/, "");
+        if (cleaned)
+          paths.push(cleaned);
+      } else if (stripped === ".env") {
+        paths.push(stripped);
+      }
+    }
+  }
+  return [...new Set(paths)];
+}
+function getSensitivePatterns() {
+  const raw = process.env.OSTACKY_SENSITIVE_PATTERNS;
+  if (!raw)
+    return SENSITIVE_DEFAULT;
+  return raw.split(",").map((s) => s.trim()).filter(Boolean);
+}
+var SENSITIVE_DEFAULT, BASH_SENSITIVE_RE;
+var init_security = __esm(() => {
+  SENSITIVE_DEFAULT = [
+    "**/.env*",
+    "**/.secrets/**",
+    "**/*.pem",
+    "**/*.key",
+    "**/.aws/**",
+    "**/.ssh/**",
+    "**/credentials.json",
+    "**/.npmrc"
+  ];
+  BASH_SENSITIVE_RE = /(?:^|[^a-zA-Z0-9_.-])(\.env(\b|[_.-])|\.secrets\b|\.pem\b|\.key\b|credentials\.json|\.aws\b|\.ssh\b|\.npmrc\b)/i;
+});
 
 // src/fs.ts
+var exports_fs = {};
+__export(exports_fs, {
+  USER_AGENT: () => USER_AGENT,
+  checkBunAvailability: () => checkBunAvailability,
+  computeTreeHash: () => computeTreeHash,
+  copyDirRecursive: () => copyDirRecursive,
+  createOpenCodeDir: () => createOpenCodeDir,
+  detectPlatformTarget: () => detectPlatformTarget,
+  downloadAndExtract: () => downloadAndExtract,
+  downloadAndExtractWithRetry: () => downloadAndExtractWithRetry,
+  downloadToFile: () => downloadToFile,
+  downloadWithRetry: () => downloadWithRetry,
+  ensureOpenCodePaths: () => ensureOpenCodePaths,
+  ensureToolDirs: () => ensureToolDirs,
+  findBinaryInDir: () => findBinaryInDir,
+  findExecutablePath: () => findExecutablePath,
+  findOpenCodeDir: () => findOpenCodeDir,
+  findProjectRoot: () => findProjectRoot,
+  getBunInstallCommand: () => getBunInstallCommand,
+  getCommandInvocation: () => getCommandInvocation,
+  getEngramReleaseTarget: () => getEngramReleaseTarget,
+  getExecutableName: () => getExecutableName,
+  getExecutableNames: () => getExecutableNames,
+  getGlobalOpenCodeDir: () => getGlobalOpenCodeDir,
+  getOpenCodeDirForScope: () => getOpenCodeDirForScope,
+  isCommandAvailable: () => isCommandAvailable,
+  parseScopeArg: () => parseScopeArg,
+  promoteStagedDirectory: () => promoteStagedDirectory,
+  shouldRetryDownload: () => shouldRetryDownload
+});
 import {
   existsSync,
   mkdirSync,
@@ -277,6 +396,22 @@ function getOpenCodeDirForScope(scope, cwd = process.cwd()) {
   }
   return getGlobalOpenCodeDir();
 }
+function parseScopeArg(argv = process.argv) {
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--scope" && i + 1 < argv.length) {
+      const v3 = argv[i + 1];
+      if (v3 === "local" || v3 === "global" || v3 === "auto")
+        return v3;
+    }
+    if (arg.startsWith("--scope=")) {
+      const v3 = arg.split("=")[1];
+      if (v3 === "local" || v3 === "global" || v3 === "auto")
+        return v3;
+    }
+  }
+  return null;
+}
 function ensureOpenCodePaths(opencodeDir) {
   const paths = {
     root: opencodeDir,
@@ -300,6 +435,9 @@ function ensureToolDirs(toolsDir, toolNames) {
       mkdirSync(dir, { recursive: true });
   }
 }
+function createOpenCodeDir(baseDir) {
+  return ensureOpenCodePaths(join(baseDir, ".opencode"));
+}
 function copyDirRecursive(src, dest, skipGenerated = false) {
   if (!existsSync(dest))
     mkdirSync(dest, { recursive: true });
@@ -360,6 +498,44 @@ function findExecutablePath(cmd) {
     return null;
   }
 }
+function getBunInstallCommand() {
+  const platform = process.platform;
+  if (platform === "darwin" || platform === "linux") {
+    return {
+      command: "curl -fsSL https://bun.com/install | bash",
+      note: platform === "linux" ? "Requires 'unzip' package (sudo apt install unzip)" : undefined
+    };
+  }
+  if (platform === "win32") {
+    return {
+      command: 'powershell -c "irm bun.sh/install.ps1|iex"',
+      note: "Requires Windows 10 v1809 or later"
+    };
+  }
+  return {
+    command: "npm install -g bun",
+    note: "Cross-platform fallback"
+  };
+}
+function checkBunAvailability() {
+  const bunPath = findExecutablePath("bun");
+  if (bunPath) {
+    let version;
+    try {
+      version = execFileSync(bunPath, ["--version"], {
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+    } catch {}
+    return { available: true, path: bunPath, version };
+  }
+  const { command, note } = getBunInstallCommand();
+  return {
+    available: false,
+    installCommand: command,
+    installNote: note
+  };
+}
 function detectPlatformTarget(platform = process.platform, arch = process.arch) {
   let os;
   let cpu;
@@ -481,6 +657,23 @@ function downloadToFile(url, dest, timeoutMs = 180000) {
     });
   });
 }
+async function downloadWithRetry(url, dest, maxRetries = 2, timeoutMs = 180000) {
+  let lastError = null;
+  for (let attempt = 0;attempt <= maxRetries; attempt++) {
+    try {
+      await downloadToFile(url, dest, timeoutMs);
+      return;
+    } catch (err) {
+      lastError = err;
+      if (attempt < maxRetries && shouldRetryDownload(lastError)) {
+        const delay = 1000 * Math.pow(2, attempt);
+        console.error(`[download] Intento ${attempt + 1} falló: ${lastError.message}. Reintentando en ${delay}ms...`);
+        await new Promise((r2) => setTimeout(r2, delay));
+      }
+    }
+  }
+  throw lastError;
+}
 async function downloadAndExtract(url, destDir, stripComponents = 1, timeoutMs = 180000) {
   const tmp = join(dirname(destDir), `.${basename(destDir)}.download-${Date.now()}-${process.pid}`);
   if (!existsSync(tmp))
@@ -551,31 +744,31 @@ var init_fs = __esm(() => {
 var manifest_default;
 var init_manifest = __esm(() => {
   manifest_default = {
-    version: "0.7.3",
+    version: "0.8.0",
     repo: "JaimeHoracio/Ostacky",
-    tag: "v0.7.3",
+    tag: "v0.8.0",
     agents: [
       {
         name: "ostacky",
         file: "assets/agents/ostacky.md",
-        description: "Orquestador con recuperación automática (nunca se congela), ruteo por nivel de impacto, controller MCP con SDK oficial, edición segura con fallback inline, y delegación en OpenSpec + Superpowers. v0.7.3: prune de skills obsoletas, lastHandoff, getAvailableTransitions, consecutiveFailures real, mem_session_summary automático al cierre.",
-        version: "0.7.3",
-        sha256: "b6dc55a9571f9626e7912ac493cc3bfe6b0798a597f706904b2106a4a9acfcd5"
+        description: "Orquestador con recuperación automática (nunca se congela), ruteo por nivel de impacto, controller MCP con SDK oficial, edición segura con fallback inline, y delegación en OpenSpec + Superpowers. v0.8.0: prune de skills obsoletas, lastHandoff, getAvailableTransitions, consecutiveFailures real, mem_session_summary automático al cierre.",
+        version: "0.8.0",
+        sha256: "d9f94bb05a33a98d6ff0ea0b56c8eb6c3c8d456d1de1ccaac3f76ee2150b3c7b"
       }
     ],
     commands: [
       {
         name: "install-stack",
         file: "assets/commands/install-stack.md",
-        description: "Instala el stack tecnológico del proyecto (CodeGraph, skills, OpenSpec, Engram, Context7, controller MCP con SDK oficial). v0.7.3: Paso 1.5 controller expandido con verificación post-instalación y troubleshooting.",
-        version: "0.7.3",
-        sha256: "0d4bc0938110c40633b041847148d8212e34a5b5876752825cfd6e186c328b8b"
+        description: "Instala el stack tecnológico del proyecto (CodeGraph, skills, OpenSpec, Engram, controller plugin). v0.8.0: controller plugin como alma hard-gate, Context7 removido del stack.",
+        version: "0.8.0",
+        sha256: "1a8acef8dd59d80aa54fa0febb4bd86a31ed615dea5257ea7fa8ed4fd51836a5"
       },
       {
         name: "opsx-sync",
         file: "assets/commands/opsx-sync.md",
         description: "Sincroniza delta specs del change activo sin inicializar CodeGraph si ya existe índice",
-        version: "0.7.3",
+        version: "0.8.0",
         sha256: "fe0158478f2ca63b315037a85fc1632b77868532e319af6c7384285441767d64"
       }
     ],
@@ -583,15 +776,15 @@ var init_manifest = __esm(() => {
       {
         name: "ostacky-controller",
         file: "assets/mcp/ostacky-controller/",
-        description: "Máquina de estados persistida con @modelcontextprotocol/server SDK. v0.7.3: 22 tools (incluye set_handoff, get_handoff, clear_handoff, get_available_transitions funcional). Bugfixes: consecutiveFailures real, lastHandoff state, defaultChoice persistido. Robustez: degraded mode automático tras 3 fallos, persistence condicional para Nivel 0, prune de skills obsoletas.",
-        version: "0.7.3",
-        sha256: "d723afc107c8a36721e7f04dc1c16694a617cd562492e1ece362482c9023b945"
+        description: "Máquina de estados persistida con @modelcontextprotocol/server SDK. v0.8.0: 22 tools (incluye set_handoff, get_handoff, clear_handoff, get_available_transitions funcional). Bugfixes: consecutiveFailures real, lastHandoff state, defaultChoice persistido. Robustez: degraded mode automático tras 3 fallos, persistence condicional para Nivel 0, prune de skills obsoletas.",
+        version: "0.8.0",
+        sha256: "5c4787001143ad517714e9c44f85b20fac00ba4146631d68486a90b93aa58dcd"
       },
       {
         name: "openspec",
         file: "assets/mcp/openspec/",
         description: "MCP server local para OpenSpec - proposal, apply, archive, sync de cambios",
-        version: "0.7.3",
+        version: "0.8.0",
         sha256: "fa4be28bfc1e75db8f1a037e2580f04a60066c80e8e5934e90e1041020d04609"
       }
     ],
@@ -600,106 +793,106 @@ var init_manifest = __esm(() => {
         name: "brainstorming",
         file: "assets/skills/brainstorming/SKILL.md",
         description: "Skill unificado de pensamiento con dos modos: creative-design (producción de diseño → transición a implementación directa o openspec-propose) y open-exploration (exploración libre)",
-        version: "0.7.3",
-        sha256: "333810ca63450e8ab795e8c5a58e645101e788d79210ca8ac36e10d11be39585"
+        version: "0.8.0",
+        sha256: "87f8d6ed28205f9272792d3865d8cd3232ab5e511a604d6d63d41e3a02a5f422"
       },
       {
         name: "execution-mode-evaluation",
         file: "assets/skills/execution-mode-evaluation/SKILL.md",
         description: "Skill de análisis de modo de ejecución — output reconciliado con controller snapshot contract (recommendation field)",
-        version: "0.7.3",
-        sha256: "e17f1e0309572841dc1fa537b1f32c7468eb70b3acf453b9ff5cc4fa8d94fd39"
+        version: "0.8.0",
+        sha256: "7b89dda29927c88f1eb13ffcea541a12423384c172f66c4f3d9b61efe0c7a163"
       },
       {
         name: "tdd",
         file: "assets/skills/tdd/SKILL.md",
         description: "Skill de test-driven development (Superpowers)",
-        version: "0.7.3",
+        version: "0.8.0",
         sha256: "aa412298980b7826165c211145c1b8e9135f68f36247bb3cb96d0a0eae274486"
       },
       {
         name: "subagent-driven-development",
         file: "assets/skills/subagent-driven-development/SKILL.md",
         description: "Skill de ejecución con subagentes (Superpowers) — ejecuta solo después de confirmación del coordinador Ostacky",
-        version: "0.7.3",
+        version: "0.8.0",
         sha256: "1a42d714a9a13faf05f0bf7b580e8d837c2e77a5633839542ccce603023419e8"
       },
       {
         name: "dispatching-parallel-agents",
         file: "assets/skills/dispatching-parallel-agents/SKILL.md",
         description: "Skill de dispatch paralelo de agentes (Superpowers)",
-        version: "0.7.3",
+        version: "0.8.0",
         sha256: "3c8a66d51ae2e719e877d02c3dac32bd804722c3bb9227c258ecae78252a20ab"
       },
       {
         name: "review",
         file: "assets/skills/review/SKILL.md",
         description: "Skill de revisión de código (Superpowers)",
-        version: "0.7.3",
+        version: "0.8.0",
         sha256: "b19650ed4d1d4d9857a4dd5b7e08e91328a1a1fc9c45bcc2fb600fa9d0213279"
       },
       {
         name: "receiving-code-review",
         file: "assets/skills/receiving-code-review/SKILL.md",
         description: "Skill de recibir y procesar feedback de code review",
-        version: "0.7.3",
+        version: "0.8.0",
         sha256: "d761e884e71d8d3476ac734d287cae403a4024506a7d12e7361a448217c0a831"
       },
       {
         name: "openspec-propose",
         file: "assets/skills/openspec-propose/SKILL.md",
         description: "Skill de generación de proposal (OpenSpec)",
-        version: "0.7.3",
+        version: "0.8.0",
         sha256: "bb59100b9fd3c9f9a1ec6509fa975ec55bf7fc737df4fe73bb3e9bbc217b83f7"
       },
       {
         name: "openspec-apply-change",
         file: "assets/skills/openspec-apply-change/SKILL.md",
         description: "Skill de aplicación de change (OpenSpec)",
-        version: "0.7.3",
+        version: "0.8.0",
         sha256: "dfc823bf89fc7505e91ab6dee9c1f004be38a410bd3d88fb67b211b1b6cbb1d0"
       },
       {
         name: "openspec-archive-change",
         file: "assets/skills/openspec-archive-change/SKILL.md",
         description: "Skill de archivo de change (OpenSpec)",
-        version: "0.7.3",
+        version: "0.8.0",
         sha256: "16e4b561de7747283663fed602e506abf502452c49a8d4b86d7a5539c40f0195"
       },
       {
         name: "openspec-explore",
         file: "assets/skills/openspec-explore/SKILL.md",
         description: "Modo explore para OpenSpec — thinking partner para explorar ideas, investigar problemas y clarificar requisitos antes/durante un cambio",
-        version: "0.7.3",
+        version: "0.8.0",
         sha256: "37ae4aaf17ea71a395bab6dc4d9d61b9a49d7910f6692535ae8553244c46880b"
       },
       {
         name: "using-git-worktrees",
         file: "assets/skills/using-git-worktrees/SKILL.md",
         description: "Skill de uso de git worktrees para aislamiento de trabajo",
-        version: "0.7.3",
+        version: "0.8.0",
         sha256: "93341bc1b7c053618a8b6dc07e3615b77990d7b549a0201f5835d95fef67ce13"
       },
       {
         name: "using-superpowers",
         file: "assets/skills/using-superpowers/SKILL.md",
         description: "Skill de orquestación de Superpowers skills",
-        version: "0.7.3",
+        version: "0.8.0",
         sha256: "7e54536f96d2a379185a10bfc1e970850caa2561b6d8aca7080f0defea0381a4"
       },
       {
         name: "writing-skills",
         file: "assets/skills/writing-skills/SKILL.md",
         description: "Skill de creación y edición de skills",
-        version: "0.7.3",
+        version: "0.8.0",
         sha256: "3d76b906cee518a2b809febb70db95697a35b9f368986bb504b4120c3bfb437a"
       },
       {
         name: "graceful-degradation",
         file: "assets/skills/graceful-degradation/SKILL.md",
         description: "Skill de degradación graceful cuando múltiples tools están indisponibles",
-        version: "0.7.3",
-        sha256: "630b87c16d78212c865696ca5df6abb0834606095ffe0e80cff8e04350f01054"
+        version: "0.8.0",
+        sha256: "40f929e8032b70d51b3548bddcc383b931d6044fd9d4acce8a5b9f7acd014f59"
       }
     ]
   };
@@ -740,6 +933,19 @@ var init_cache = __esm(() => {
 });
 
 // src/github.ts
+var exports_github = {};
+__export(exports_github, {
+  BUNDLED_MCP_DIR: () => BUNDLED_MCP_DIR,
+  BUNDLED_SKILLS_DIR: () => BUNDLED_SKILLS_DIR,
+  PACKAGE_ROOT: () => PACKAGE_ROOT,
+  downloadFile: () => downloadFile,
+  fetchLatestManifest: () => fetchLatestManifest,
+  fetchLatestReleaseTag: () => fetchLatestReleaseTag,
+  fetchManifest: () => fetchManifest,
+  getBundledMcpPath: () => getBundledMcpPath,
+  getBundledSkillPath: () => getBundledSkillPath,
+  getRawUrl: () => getRawUrl
+});
 import { fileURLToPath } from "url";
 import { dirname as dirname3, join as join3 } from "path";
 function getBundledSkillPath(name) {
@@ -840,12 +1046,12 @@ var init_github = __esm(() => {
 // src/lockfile.ts
 var exports_lockfile = {};
 __export(exports_lockfile, {
-  writeLockfile: () => writeLockfile,
-  removeFromLockfile: () => removeFromLockfile,
-  readLockfile: () => readLockfile,
-  getLockfilePath: () => getLockfilePath,
+  clearLockfile: () => clearLockfile,
   getInstalledVersion: () => getInstalledVersion,
-  clearLockfile: () => clearLockfile
+  getLockfilePath: () => getLockfilePath,
+  readLockfile: () => readLockfile,
+  removeFromLockfile: () => removeFromLockfile,
+  writeLockfile: () => writeLockfile
 });
 import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import { join as join4 } from "path";
@@ -910,16 +1116,16 @@ var init_lockfile = __esm(() => {
 // src/config.ts
 var exports_config = {};
 __export(exports_config, {
-  writeOpenCodeConfig: () => writeOpenCodeConfig,
-  stripJsoncComments: () => stripJsoncComments,
-  setMcpEntryAtProjectRoot: () => setMcpEntryAtProjectRoot,
-  setMcpEntry: () => setMcpEntry,
-  readOpenCodeConfig: () => readOpenCodeConfig,
-  patchOpenCodeConfig: () => patchOpenCodeConfig,
-  findOpenCodeConfig: () => findOpenCodeConfig,
-  ensureOpenCodeConfig: () => ensureOpenCodeConfig,
+  ensureMcpEntry: () => ensureMcpEntry,
   ensureMcpEntryAtProjectRoot: () => ensureMcpEntryAtProjectRoot,
-  ensureMcpEntry: () => ensureMcpEntry
+  ensureOpenCodeConfig: () => ensureOpenCodeConfig,
+  findOpenCodeConfig: () => findOpenCodeConfig,
+  patchOpenCodeConfig: () => patchOpenCodeConfig,
+  readOpenCodeConfig: () => readOpenCodeConfig,
+  setMcpEntry: () => setMcpEntry,
+  setMcpEntryAtProjectRoot: () => setMcpEntryAtProjectRoot,
+  stripJsoncComments: () => stripJsoncComments,
+  writeOpenCodeConfig: () => writeOpenCodeConfig
 });
 import { existsSync as existsSync4, readFileSync as readFileSync4, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
 import { join as join5 } from "path";
@@ -1054,6 +1260,12 @@ function patchOpenCodeConfig(projectRoot = findProjectRoot()) {
     delete config.plugin;
     changed = true;
   }
+  if (config.mcp && typeof config.mcp === "object" && "context7" in config.mcp) {
+    delete config.mcp.context7;
+    if (Object.keys(config.mcp).length === 0)
+      delete config.mcp;
+    changed = true;
+  }
   if (changed) {
     writeOpenCodeConfig(configPath, config);
     return { success: true, message: "Config actualizada (plugin legacy eliminado)" };
@@ -1067,17 +1279,16 @@ var init_config = __esm(() => {
 // src/stack.ts
 var exports_stack = {};
 __export(exports_stack, {
-  verifyMcpServers: () => verifyMcpServers,
-  uninstallStackConfig: () => uninstallStackConfig,
-  uninstallEngramConfig: () => uninstallEngramConfig,
-  setupOpenSpec: () => setupOpenSpec,
-  setupContext7: () => setupContext7,
-  installStack: () => installStack,
-  installEngram: () => installEngram,
-  installCodeGraph: () => installCodeGraph,
-  buildLocalMcpCommand: () => buildLocalMcpCommand,
+  OPENSPEC_NPM_PACKAGE: () => OPENSPEC_NPM_PACKAGE,
   buildEngramDownloadUrl: () => buildEngramDownloadUrl,
-  OPENSPEC_NPM_PACKAGE: () => OPENSPEC_NPM_PACKAGE
+  buildLocalMcpCommand: () => buildLocalMcpCommand,
+  installCodeGraph: () => installCodeGraph,
+  installEngram: () => installEngram,
+  installStack: () => installStack,
+  setupOpenSpec: () => setupOpenSpec,
+  uninstallEngramConfig: () => uninstallEngramConfig,
+  uninstallStackConfig: () => uninstallStackConfig,
+  verifyMcpServers: () => verifyMcpServers
 });
 import { chmodSync, copyFileSync as copyFileSync3, existsSync as existsSync6, mkdirSync as mkdirSync4, rmSync as rmSync4, unlinkSync as unlinkSync3 } from "fs";
 import { basename as basename2, dirname as dirname5, join as join7, resolve as resolve2 } from "path";
@@ -1127,6 +1338,15 @@ function copyEngramPlugin(projectRoot) {
   mkdirSync4(pluginsDir, { recursive: true });
   copyFileSync3(pluginSource, join7(pluginsDir, "engram.ts"));
 }
+function copyOstackyControllerPlugin(projectRoot) {
+  const pluginSource = join7(PACKAGE_ROOT, "assets", "plugins", "ostacky-plugin.ts");
+  const pluginsDir = join7(projectRoot, ".opencode", "plugins");
+  if (!existsSync6(pluginSource)) {
+    throw new Error(`Plugin bundleado de OstackyController no encontrado: ${pluginSource}`);
+  }
+  mkdirSync4(pluginsDir, { recursive: true });
+  copyFileSync3(pluginSource, join7(pluginsDir, "ostacky-plugin.ts"));
+}
 function buildEngramDownloadUrl(tag, platform = process.platform, arch = process.arch) {
   const target = getEngramReleaseTarget(platform, arch);
   if (!target)
@@ -1350,6 +1570,7 @@ async function installEngram(toolsDir) {
   try {
     runTool(localBin, ["--version"], projectRoot, 1e4);
     copyEngramPlugin(projectRoot);
+    copyOstackyControllerPlugin(projectRoot);
     configureLocalTool(projectRoot, "engram", buildLocalMcpCommand(localBin, ["mcp"]));
   } catch (error) {
     return failAfterExtraction(`Engram fue instalado pero no se pudo verificar o configurar: ${error.message}`);
@@ -1357,44 +1578,15 @@ async function installEngram(toolsDir) {
   archivePromotion?.commit();
   return { success: true, message: "Engram instalado localmente y configurado para OpenCode (MCP + plugin)" };
 }
-function setupContext7(toolsDir) {
-  const location = resolveToolInstallLocation(toolsDir);
-  const { projectRoot } = location;
-  const ctx7ToolDir = join7(location.toolsDir, "context7");
-  if (!existsSync6(ctx7ToolDir))
-    mkdirSync4(ctx7ToolDir, { recursive: true });
-  try {
-    ensureMcpEntryAtProjectRoot(projectRoot, "context7", {
-      type: "remote",
-      url: "https://mcp.context7.com/mcp",
-      enabled: true
-    });
-  } catch (error) {
-    return { success: false, message: `No se pudo registrar Context7: ${error.message}` };
-  }
-  const useBun = isCommandAvailable("bun");
-  try {
-    const invocation = getCommandInvocation(useBun ? "bunx" : "npx", useBun ? ["ctx7", "setup", "--opencode"] : ["--yes", "ctx7", "setup", "--opencode"]);
-    execFileSync3(invocation.command, invocation.args, {
-      stdio: "pipe",
-      timeout: 60000,
-      cwd: projectRoot
-    });
-    return { success: true, message: "Context7 configurado (MCP + skill instalado)" };
-  } catch {
-    return {
-      success: true,
-      message: "Context7 MCP registrado (skill opcional no instalada — corrí `npx ctx7 setup --opencode` manualmente si la querés)"
-    };
-  }
-}
 async function installStack(toolsDir) {
   const { projectRoot } = resolveToolInstallLocation(toolsDir);
+  try {
+    copyOstackyControllerPlugin(projectRoot);
+  } catch {}
   return {
     codegraph: await installCodeGraph(toolsDir),
     openspec: setupOpenSpec(projectRoot),
     engram: await installEngram(toolsDir),
-    context7: setupContext7(toolsDir),
     config: patchOpenCodeConfig(projectRoot)
   };
 }
@@ -1429,7 +1621,7 @@ function uninstallStackConfig(paths) {
       const mcp = config.mcp;
       let changed = false;
       if (mcp) {
-        for (const name of ["codegraph", "context7", "engram"]) {
+        for (const name of ["codegraph", "engram", "context7"]) {
           if (name in mcp) {
             delete mcp[name];
             removed.push(`mcp.${name}`);
@@ -1499,7 +1691,7 @@ var init_stack = __esm(() => {
 // package.json
 var package_default = {
   name: "ostacky",
-  version: "0.7.3",
+  version: "0.8.0",
   description: "Instalador interactivo de agentes y comandos para OpenCode",
   type: "module",
   bin: {
@@ -1548,23 +1740,23 @@ var package_default = {
 // node_modules/@clack/prompts/dist/index.mjs
 var exports_dist = {};
 __export(exports_dist, {
-  updateSettings: () => hD,
-  text: () => ue,
-  tasks: () => xe,
-  spinner: () => L2,
-  selectKey: () => he,
-  select: () => de,
-  password: () => $e,
-  outro: () => fe,
-  note: () => ye,
-  multiselect: () => pe,
-  log: () => v2,
-  isCancel: () => BD,
-  intro: () => we,
-  groupMultiselect: () => ge,
-  group: () => be,
+  cancel: () => ve,
   confirm: () => me,
-  cancel: () => ve
+  group: () => be,
+  groupMultiselect: () => ge,
+  intro: () => we,
+  isCancel: () => BD,
+  log: () => v2,
+  multiselect: () => pe,
+  note: () => ye,
+  outro: () => fe,
+  password: () => $e,
+  select: () => de,
+  selectKey: () => he,
+  spinner: () => L2,
+  tasks: () => xe,
+  text: () => ue,
+  updateSettings: () => hD
 });
 import { stripVTControlCharacters as T2 } from "node:util";
 
@@ -2674,7 +2866,7 @@ async function probeMcpServer(nodeExecutable, serverPath, cwd, statePath, option
         params: {
           protocolVersion: "2025-03-26",
           capabilities: {},
-          clientInfo: { name: "ostacky-installer", version: "0.7.3" }
+          clientInfo: { name: "ostacky-installer", version: "0.8.0" }
         }
       });
     });
@@ -3188,11 +3380,6 @@ async function doInstallStack(toolsDir, projectRoot) {
   spin.stop(eng.success ? `✓ ${eng.message}` : `✗ ${eng.message}`);
   if (!eng.success)
     allOk = false;
-  spin.start("Configurando Context7...");
-  const ctx = setupContext7(toolsDir);
-  spin.stop(ctx.success ? `✓ ${ctx.message}` : `✗ ${ctx.message}`);
-  if (!ctx.success)
-    allOk = false;
   spin.start("Verificando configuración...");
   const { patchOpenCodeConfig: patchOpenCodeConfig2 } = await Promise.resolve().then(() => (init_config(), exports_config));
   const cfg = patchOpenCodeConfig2(resolvedProjectRoot);
@@ -3209,9 +3396,9 @@ async function doInstallAll(manifest, paths) {
   let errors = 0;
   const isGlobal = isGlobalScope(paths);
   if (!isGlobal) {
-    ensureToolDirs(paths.tools, ["codegraph", "engram", "context7"]);
+    ensureToolDirs(paths.tools, ["codegraph", "engram"]);
   } else {
-    v2.info("Scope global detectado: el stack (CodeGraph/Engram) permanece siempre en <proyecto>/.opencode/tools — se omite instalación de stack global.");
+    v2.info("Scope global detectado: el stack (CodeGraph/Engram) y plugins (ostacky-controller, engram) permanecen siempre en <proyecto>/.opencode — se omite instalación de stack global.");
     v2.info("Para instalar el stack, ejecutá 'npx ostacky install-stack --scope local' dentro de cada proyecto.");
   }
   for (const agent of manifest.agents) {
@@ -3258,6 +3445,42 @@ async function doInstallAll(manifest, paths) {
       errors++;
     }
   }
+  try {
+    const { copyFileSync: copyFileSync4, mkdirSync: mkdirSync5, existsSync: existsSync8 } = await import("fs");
+    const { join: join9 } = await import("path");
+    const { PACKAGE_ROOT: PACKAGE_ROOT2 } = await Promise.resolve().then(() => (init_github(), exports_github));
+    const { findProjectRoot: findProjectRoot3 } = await Promise.resolve().then(() => (init_fs(), exports_fs));
+    const src = join9(PACKAGE_ROOT2, "assets", "plugins", "ostacky-plugin.ts");
+    const dest = join9(paths.plugins, "ostacky-plugin.ts");
+    if (existsSync8(src)) {
+      mkdirSync5(paths.plugins, { recursive: true });
+      copyFileSync4(src, dest);
+    }
+    const legacySrc = join9(PACKAGE_ROOT2, "assets", "plugins", "ostacky-controller.ts");
+    if (!existsSync8(src) && existsSync8(legacySrc)) {
+      mkdirSync5(paths.plugins, { recursive: true });
+      copyFileSync4(legacySrc, join9(paths.plugins, "ostacky-controller.ts"));
+    }
+    const srcEng = join9(PACKAGE_ROOT2, "assets", "plugins", "engram.ts");
+    const destEng = join9(paths.plugins, "engram.ts");
+    if (existsSync8(srcEng)) {
+      mkdirSync5(paths.plugins, { recursive: true });
+      copyFileSync4(srcEng, destEng);
+    }
+    if (isGlobal) {
+      try {
+        const projRoot = findProjectRoot3();
+        const localPlugins = join9(projRoot, ".opencode", "plugins");
+        mkdirSync5(localPlugins, { recursive: true });
+        if (existsSync8(src))
+          copyFileSync4(src, join9(localPlugins, "ostacky-plugin.ts"));
+        else if (existsSync8(legacySrc))
+          copyFileSync4(legacySrc, join9(localPlugins, "ostacky-controller.ts"));
+        if (existsSync8(srcEng))
+          copyFileSync4(srcEng, join9(localPlugins, "engram.ts"));
+      } catch {}
+    }
+  } catch {}
   let stackOk = true;
   let missingTools = [];
   if (isGlobal) {
@@ -3804,7 +4027,7 @@ async function runInteractiveMenu(scope) {
       { value: "command", label: "Instalar command" },
       { value: "skill", label: "Instalar skill" },
       { value: "mcp", label: "Instalar MCP server" },
-      { value: "stack", label: "Instalar stack de herramientas (CodeGraph, Engram, Context7)" },
+      { value: "stack", label: "Instalar stack de herramientas (CodeGraph, Engram)" },
       { value: "update", label: "Actualizar instalación" },
       { value: "uninstall", label: "Desinstalar" },
       { value: "exit", label: "Salir" }
@@ -3845,7 +4068,7 @@ async function runInteractiveMenu(scope) {
         fe("Cancelado.");
         break;
       }
-      ensureToolDirs(paths.tools, ["codegraph", "engram", "context7"]);
+      ensureToolDirs(paths.tools, ["codegraph", "engram"]);
       const stackOk = await doInstallStack(paths.tools, dirname7(paths.root));
       if (!stackOk)
         process.exitCode = 1;
@@ -3948,7 +4171,7 @@ async function runInstallStackCommand(scope) {
     process.exitCode = 1;
     return;
   }
-  ensureToolDirs(paths.tools, ["codegraph", "engram", "context7"]);
+  ensureToolDirs(paths.tools, ["codegraph", "engram"]);
   const stackOk = await doInstallStack(paths.tools, dirname7(paths.root));
   if (!stackOk)
     process.exitCode = 1;
@@ -3962,7 +4185,7 @@ async function runUninstallStackCommand(scope) {
     return;
   }
   const confirm = await me({
-    message: "¿Remover la configuración del stack (CodeGraph, Engram, Context7) del proyecto? Los binarios globales no se tocan."
+    message: "¿Remover la configuración del stack (CodeGraph, Engram) del proyecto? Los binarios globales no se tocan."
   });
   onCancel(confirm);
   if (!confirm) {
@@ -4142,19 +4365,19 @@ async function runUninstallMcpCommand(name, scope) {
 
 // src/cli.ts
 init_fs();
-import { existsSync as existsSync8, statSync as statSync3, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync8, statSync as statSync3, readFileSync as readFileSync6, readdirSync as readdirSync3 } from "node:fs";
 import { join as join11, dirname as dirname8 } from "node:path";
 var HELP = `
 ostacky — Instalador de agentes, comandos, skills y MCPs para OpenCode
 
 Uso:
   npx ostacky [--scope local|global|auto]                    Menú interactivo (instalación completa, pregunta local vs global, default local)
-  npx ostacky install [--scope local|global|auto]            Instalar TODO (agente + skills + MCPs + CodeGraph + OpenSpec + Engram + Context7)
+  npx ostacky install [--scope local|global|auto]            Instalar TODO (agente + skills + MCPs + CodeGraph + OpenSpec + Engram)
   npx ostacky add agent [--scope local|global|auto]          Agregar agente(s)
   npx ostacky add command [--scope ...]        Agregar command(s)
   npx ostacky add skill [--scope ...]          Agregar skill(s)
   npx ostacky add mcp [--scope ...]            Agregar MCP server(s)
-  npx ostacky install-stack [--scope local|auto]      Instalar solo el stack de herramientas (CodeGraph, OpenSpec, Engram, Context7) — global bloquea con error
+  npx ostacky install-stack [--scope local|auto]      Instalar solo el stack de herramientas (CodeGraph, OpenSpec, Engram) — global bloquea con error
   npx ostacky uninstall-stack [--scope local|global|auto]    Remover la configuración del stack del proyecto
   npx ostacky doctor                           Diagnostica locks, tools, state health
   npx ostacky status [--json]                  Muestra estado del controller sin MCP
@@ -4173,7 +4396,7 @@ Scope:
   --scope auto    Elige local si existe .opencode o .git, si no global
   Sin flag        Pregunta interactiva local (default) vs global
 `.trim();
-function parseScopeArg(argv = process.argv) {
+function parseScopeArg2(argv = process.argv) {
   for (let i = 0;i < argv.length; i++) {
     const arg = argv[i];
     if (arg === "--scope" && i + 1 < argv.length) {
@@ -4203,7 +4426,7 @@ function withoutScopeArgs(argv) {
   }
   return out;
 }
-var scope = parseScopeArg();
+var scope = parseScopeArg2();
 var argvNoScope = withoutScopeArgs(process.argv);
 var [, , cmd, subcmd] = argvNoScope;
 async function runDoctorCommand() {
@@ -4223,14 +4446,30 @@ async function runDoctorCommand() {
       hasError = true;
     }
   };
+  const pluginPaths = [
+    join11(cwd, "assets", "plugins", "ostacky-plugin.ts"),
+    join11(opencodeDir, "plugins", "ostacky-plugin.ts"),
+    join11(cwd, ".opencode", "plugins", "ostacky-plugin.ts"),
+    join11(cwd, "assets", "plugins", "ostacky-controller.ts"),
+    join11(opencodeDir, "plugins", "ostacky-controller.ts"),
+    join11(cwd, ".opencode", "plugins", "ostacky-controller.ts")
+  ];
+  const pluginActive = pluginPaths.some((p2) => existsSync8(p2));
   try {
     if (!existsSync8(statePath)) {
-      check("controller: state file missing", false, true);
+      if (pluginActive)
+        console.log(`✅ controller: plugin active (no state yet)`);
+      else
+        check("controller: state file missing", false, true);
     } else {
       const stat = statSync3(statePath);
       const raw = readFileSync6(statePath, "utf-8");
       const parsed = JSON.parse(raw);
-      check(`controller: OK (rev ${parsed.revision || 0} state ${parsed.state || "unknown"})`, true);
+      if (pluginActive) {
+        console.log(`✅ controller: plugin active (rev ${parsed.revision || 0} state ${parsed.state || "unknown"})`);
+      } else {
+        check(`controller: OK (rev ${parsed.revision || 0} state ${parsed.state || "unknown"})`, true);
+      }
       if (parsed.degraded) {
         console.log("⚠️ degraded: true (persistido)");
         hasWarn = true;
@@ -4243,6 +4482,10 @@ async function runDoctorCommand() {
         console.log(`⚠️ stateOversizedCount=${parsed.stateOversizedCount} snapshots perdidos`);
       if (parsed.sensitiveAccess)
         console.log(`ℹ️ sensitiveAccess: allowed=${parsed.sensitiveAccess.allowed || 0} denied=${parsed.sensitiveAccess.denied || 0} blocked=${parsed.sensitiveAccess.blockedAttempts || 0}`);
+      if (parsed.sensitivePatterns)
+        console.log(`ℹ️ sensitivePatterns: ${parsed.sensitivePatterns.join(", ")}`);
+      if (parsed.allowedFiles && Object.keys(parsed.allowedFiles).length)
+        console.log(`ℹ️ allowedFiles: ${Object.keys(parsed.allowedFiles).join(", ")}`);
       if (parsed.deniedFiles && Object.keys(parsed.deniedFiles).length) {
         console.log(`ℹ️ denied files: ${Object.keys(parsed.deniedFiles).join(", ")} (denied by user)`);
       }
@@ -4330,6 +4573,60 @@ async function runDoctorCommand() {
       if (s.allowedFiles || s.deniedFiles) {}
     } catch {}
   }
+  try {
+    const cacheDir = join11(opencodeDir, "cache", "codegraph");
+    if (!existsSync8(cacheDir)) {
+      console.log("ℹ️ cache: no cache dir yet (ok)");
+    } else {
+      const files = readdirSync3(cacheDir);
+      let total = 0;
+      for (const f2 of files) {
+        try {
+          total += statSync3(join11(cacheDir, f2)).size;
+        } catch {}
+      }
+      const totalMB = (total / 1048576).toFixed(2);
+      if (total > 52428800) {
+        console.log(`⚠️ cache: ${totalMB}MB >50MB — LRU cleanup needed`);
+        hasWarn = true;
+      } else {
+        console.log(`✅ cache: OK (${files.length} files, ${totalMB}MB)`);
+      }
+      try {
+        const s = JSON.parse(readFileSync6(statePath, "utf-8"));
+        if (s.cacheHitCount !== undefined) {
+          console.log(`ℹ️ cacheHitCount=${s.cacheHitCount} cacheMissCount=${s.cacheMissCount || 0} tokenSavingEstimate=${s.tokenSavingEstimate || 0}`);
+        }
+      } catch {}
+    }
+  } catch (e2) {
+    console.log(`⚠️ cache: check failed ${e2.message}`);
+  }
+  try {
+    const secPath = join11(cwd, "src", "security.ts");
+    if (!existsSync8(secPath)) {
+      console.log("⚠️ src/security.ts: missing (source-of-truth)");
+      hasWarn = true;
+    } else {
+      const sec = readFileSync6(secPath, "utf-8");
+      const hasSensitiveDefault = sec.includes("SENSITIVE_DEFAULT");
+      const hasBashRe = sec.includes("BASH_SENSITIVE_RE");
+      const hasIsSensitive = sec.includes("function isSensitive");
+      const hasExtract = sec.includes("extractPathsFromBash");
+      if (hasSensitiveDefault && hasBashRe && hasIsSensitive && hasExtract) {
+        console.log("✅ src/security.ts: source-of-truth OK");
+      } else {
+        console.log("⚠️ src/security.ts: missing exports (SENSITIVE_DEFAULT/BASH_SENSITIVE_RE/isSensitive/extractPathsFromBash)");
+        hasWarn = true;
+      }
+    }
+  } catch {}
+  try {
+    const s = JSON.parse(readFileSync6(statePath, "utf-8"));
+    if (s.sensitiveAccess?.blockedAttempts > 0) {
+      console.log(`ℹ️ sensitiveAccess: blockedAttempts includes bash (${s.sensitiveAccess.blockedAttempts})`);
+    }
+  } catch {}
   if (hasError)
     process.exit(1);
   if (hasWarn)