ostacky 0.9.1 → 0.9.3

package/README.md

@@ -145,6 +145,8 @@ Actualizaciones disponibles
 
 Solo descarga los items que cambiaron de versión.
 
+> **Nota:** `@latest` y `update` son cosas distintas. `npx ostacky@latest` fuerza a descargar la **última versión publicada** del instalador (el `@latest` es el tag de npm) y, sin subcomando, abre el menú interactivo. `npx ostacky update` corre la **acción de actualizar** (trae el manifest remoto y actualiza lo instalado según el lockfile) con la versión del instalador que npx resuelva (puede ser cacheada). Para ambas garantías, combinalos: `npx ostacky@latest update`.
+
 ### Desinstalar
 
 ```bash
@@ -246,37 +248,37 @@ Tras instalar (`--scope local`), el proyecto queda así:
 
 ```json
 {
-    "version": "0.9.1",
+    "version": "0.9.3",
     "lockedAt": "2025-01-01T00:00:00.000Z",
     "repo": "JaimeHoracio/Ostacky",
-    "tag": "v0.9.1",
+    "tag": "v0.9.3",
     "agents": {
         "ostacky": {
-            "version": "0.9.1",
+            "version": "0.9.3",
             "installedAt": "2025-01-01T00:00:00.000Z",
             "sha256": "abc123..."
         }
     },
     "commands": {
         "install-stack": {
-            "version": "0.9.1",
+            "version": "0.9.3",
             "installedAt": "2025-01-01T00:00:00.000Z",
             "sha256": "def456..."
         },
         "opsx-sync": {
-            "version": "0.9.1",
+            "version": "0.9.3",
             "installedAt": "2025-01-01T00:00:00.000Z",
             "sha256": "ghi789..."
         }
     },
     "skills": {
-        "brainstorming": { "version": "0.9.1", ... },
-        "execution-mode-evaluation": { "version": "0.9.1", ... },
-        "openspec-propose": { "version": "0.9.1", ... }
+        "brainstorming": { "version": "0.9.3", ... },
+        "execution-mode-evaluation": { "version": "0.9.3", ... },
+        "openspec-propose": { "version": "0.9.3", ... }
     },
     "mcpServers": {
-        "ostacky-controller": { "version": "0.9.1", ... },
-        "openspec": { "version": "0.9.1", ... }
+        "ostacky-controller": { "version": "0.9.3", ... },
+        "openspec": { "version": "0.9.3", ... }
     }
 }
 ```
@@ -308,7 +310,7 @@ Es opcional y solo necesario si algo falló durante la instalación o si querés
 ## Seguridad
 
 - `opencode.jsonc` se versiona en el repo para compartir permisos y MCP de forma reproducible.
-- Las URLs de descarga usan **tags de GitHub** (ej. `v0.9.1`), nunca `main` — instalaciones reproducibles
+- Las URLs de descarga usan **tags de GitHub** (ej. `v0.9.3`), nunca `main` — instalaciones reproducibles
 - Cada path de archivo descargado es validado para prevenir **path traversal**
 - Los archivos incluyen **checksum SHA-256** opcional; si el manifest lo define, el contenido se verifica antes de escribir
 - El cache local (`.opencode/cache/`) también valida integridad al servir archivos cacheados
@@ -365,7 +367,7 @@ CodeGraph está instalado en `.opencode/tools/codegraph/bin/codegraph` y se conf
 | `.opencode/tools/codegraph/bin/codegraph status`                                           | Muestra estado del index y archivos pendientes              |
 | `.opencode/tools/codegraph/bin/codegraph install --target opencode --location local --yes` | Configura CodeGraph para OpenCode y genera AGENTS.md        |
 
-> **Windows:** si ves `Command failed: cmd.exe /d /c call ... codegraph.cmd init -i` durante `npx ostacky install`, es un _warning_ no fatal — el binario se instaló pero el índice no se pudo crear. Reintentá con `npx ostacky install-stack --scope local` o ejecutá manualmente `.opencode\tools\codegraph\bin\codegraph.exe init -i` (o `codegraph.cmd` si no hay `.exe`) dentro del proyecto. Desde v0.9.1 el instalador usa el patrón resiliente de Engram (strip 0 + búsqueda recursiva) y loguea `projectRoot|toolsDir` para diagnosticar scope.
+> **Windows:** si ves `Command failed: cmd.exe /d /c call ... codegraph.cmd init -i` durante `npx ostacky install`, es un _warning_ no fatal — el binario se instaló pero el índice no se pudo crear. Reintentá con `npx ostacky install-stack --scope local` o ejecutá manualmente `.opencode\tools\codegraph\bin\codegraph.exe init -i` (o `codegraph.cmd` si no hay `.exe`) dentro del proyecto. Desde v0.9.3 el instalador usa el patrón resiliente de Engram (strip 0 + búsqueda recursiva) y loguea `projectRoot|toolsDir` para diagnosticar scope.
 
 ## Licencia
 

package/assets/agents/ostacky.md

@@ -1,12 +1,12 @@
 ---
 description: Orquestador principal — rutea por nivel, orquesta CodeGraph + OpenSpec + Superpowers.
 mode: primary
-version: 0.9.1
+version: 0.9.3
 ---
 
-Sos **Ostacky v0.9.1**, orquestás, no implementás. Interpretás, clasificás (0/0+1/1+), ruteás y coordinás.
+Sos **Ostacky v0.9.3**, orquestás, no implementás. Interpretás, clasificás (0/0+1/1+), ruteás y coordinás.
 
-> **Versión:** `0.9.1` (sincronizada desde `package.json` vía `scripts/sync-version.ts`). Cuando te pregunten qué versión tenés, qué versión sos, o `¿qué versión tenés?` / `version` / `¿en qué versión estás?`, respondé exactamente: **"Ostacky v0.9.1"** (o `v0.9.1` si te piden solo el número). No inventes otra versión.
+> **Versión:** `0.9.3` (sincronizada desde `package.json` vía `scripts/sync-version.ts`). Cuando te pregunten qué versión tenés, qué versión sos, o `¿qué versión tenés?` / `version` / `¿en qué versión estás?`, respondé exactamente: **"Ostacky v0.9.3"** (o `v0.9.3` si te piden solo el número). No inventes otra versión.
 
 ## Reglas innegociables
 
@@ -85,13 +85,13 @@ Router `brainstorming`↔`OpenSpec` por `level`/`estLines`/`fileCount`/`hasAPI`
 
 1. `skill(execution-mode-evaluation)` en memoria, reusa discovery.
 2. Mostrar análisis → `¿Procedo?` → `record_execution_analysis` → `consume_execution_decision`.
-3. Por task: `Read` fresco → plugin valida edición in-process → `edit` → `verifyTask` (genérico: `codegraph:<Symbol>` con `codegraph_codegraph_explore`, `file:<path> contiene <string>` con `Read`/`Grep`, `test:<cmd>` con `shell` acotado — según `— verificar:` de `tasks.md`) → solo si `verifyTask.ok` → `complete_task`. **NUNCA marques `complete_task` a ojo**; si `verifyTask` falla, reintentá el fix.
+3. Por task: `Read` fresco → plugin valida edición in-process → `edit` → `verifyTask` (genérico: `codegraph:<Symbol>` con `codegraph_codegraph_explore`, `file:<path> contiene <string>` con `Read`/`Grep`, `test:<cmd>` con `shell` acotado — según `— verificar:` de `tasks.md`) → solo si `verifyTask.ok` → `complete_task`. **NUNCA marques `complete_task` a ojo**; si `verifyTask` falla, reintentá el fix. Vale para SPEC y DIRECT, INLINE y SUBAGENTS.
 
 ### 5. Sync y cierre
 
 1. Tests + review
 2. `saveSessionClose` → `mem_session_summary` + `set_handoff` paralelo
-3. `verifyIntegrity` → **si `pending.length > 0` NO llames `implementation_complete`**; lista explícita `Te faltan N tasks: [...]` y pide `complete_task`. Solo si `pending === 0` y `staleFiles === 0`, `implementation_complete` → `sync_complete`. **NUNCA llames `implementation_complete` automáticamente con pendientes** — espera a que el usuario complete o escriba literal `"confirmo forzar"` para `force:true` (queda auditado).
+3. `verifyIntegrity` → **si `pending.length > 0` NO llames `implementation_complete`**; lista explícita `Te faltan N tasks: [...]` y pide `complete_task`. Si `staleFiles.length > 0` por refino post-complete (archivo ya correcto, sin edición pendiente): llamá `refresh_fingerprint({filePath})` por cada archivo y reintentá `implementation_complete` sin `force`. Solo si `pending === 0` y `staleFiles === 0`, `implementation_complete` → `sync_complete`. **NUNCA llames `implementation_complete` automáticamente con pendientes** — espera a que el usuario complete o escriba literal `"confirmo forzar"` para `force:true` (queda auditado). Vale para SPEC y DIRECT, INLINE y SUBAGENTS.
 
 ## Guardrails
 

package/assets/commands/install-stack.md

@@ -5,13 +5,13 @@ agent: build
 
 Instala el stack tecnológico de desarrollo para OpenCode. **IMPORTANTE:** las herramientas se instalan por separado (cada una con su propio CLI/comando). `npx ostacky install` solo instala el agente y commands de Ostacky en `.opencode/`. Este comando (`/install-stack`) es la guía de referencia para la instalación manual completa paso a paso.
 
-**Nota:** A partir de v0.9.1, `npx ostacky install` ya instala automáticamente el stack completo (CodeGraph, OpenSpec, Engram, MCPs bundleados) además del agente y skills. Este comando es útil para instalación manual, verificación, o cuando algo falló y necesita reinstalarse.
+**Nota:** A partir de v0.9.3, `npx ostacky install` ya instala automáticamente el stack completo (CodeGraph, OpenSpec, Engram, MCPs bundleados) además del agente y skills. Este comando es útil para instalación manual, verificación, o cuando algo falló y necesita reinstalarse.
 
 **RESTRICCIÓN ABSOLUTA:** instalar ÚNICAMENTE para OpenCode. Está terminantemente prohibido crear o modificar archivos en `.claude/`, `.kiro/`, `.cursor/`, `.gemini/`, `.codex/`, `.antigravity/`, `.windsurf/` o cualquier otro directorio de plataformas externas.
 
 **Origen del set curado:** el set de 15 skills referenciado en `assets/agents/ostacky.md` está bundleado en `assets/skills/` dentro del paquete npm. La definición del set y su trazabilidad viven en `manifest.json` y `.opencode/ostacky-lock.json`.
 
-## Scope de instalación — local vs global (desde v0.9.1)
+## Scope de instalación — local vs global (desde v0.9.3)
 
 `npx ostacky install` soporta `--scope local|global|auto` (también `--scope=...`):
 

package/assets/docs/ostacky-reference.md

@@ -48,6 +48,10 @@ Allowlist: `.env.example/.template/.sample` nunca bloquea. `extractPathsFromBash
 
 `content` requerido salvo `content:"hash:"+fastFingerprint` cuando `lastValidated.filePath==filePath && fingerprint==hash` y fingerprint coincide con disco → EDITABLE sin body. Hash stale → CONFLICT `stale fingerprint`.
 
+## refresh_fingerprint (revalidación sin churn)
+
+Tras refino post-complete (archivo ya correcto, sin edición pendiente): `refresh_fingerprint({filePath})` o `refresh_fingerprint({taskId})` re-sincroniza `tasks[].fileHash` + `fileFingerprints` con disco, sin `oldString/newString`. Vale para SPEC y DIRECT, en `EXECUTING_INLINE`, `EXECUTING_SUBAGENTS` y `SPECIFICATION`. Luego `verifyIntegrity.ok` → `implementation_complete` sin `force`.
+
 ## Enforcement (plugin)
 
 El plugin hace cumplir `PENDING` en `ctx.tool.hook("execute.before")`; `lastCheck={revision, result}` cachea ALLOW por revisión, revalida si cambia o >5 tools; `BLOCKED` nunca cacheado. Métricas `stateCheckCount` cuentan checks del plugin (no del LLM).
@@ -64,15 +68,15 @@ Principio: **eficacia > recorte** — si recorte rompiera caché y saliera más
 
 ## Security single-source
 
-`src/security.ts` único origen de `SENSITIVE_DEFAULT`/`BASH_SENSITIVE_RE`/`isSensitive`/`extractPathsFromBash` (import `node:crypto`); mirrors generados en `assets/plugins/security.ts` (solo Sensitive guard, sin crypto) y `assets/mcp/ostacky-controller/security.js` vía `bun run scripts/sync-controller-core.ts`. `ostacky-plugin.ts` importa de `./security.ts` self-contained (no `../../src`). `BASH_SENSITIVE_RE` arriba. `OSTACKY_SENSITIVE_PATTERNS` override.
+`src/security.ts` único origen de `SENSITIVE_DEFAULT`/`BASH_SENSITIVE_RE`/`isSensitive`/`extractPathsFromBash` (import `node:crypto`); mirrors generados en `assets/plugins/ostacky-controller/security.ts` (solo Sensitive guard, sin crypto) y `assets/mcp/ostacky-controller/security.js` vía `bun run scripts/sync-controller-core.ts`. `assets/plugins/ostacky-controller/index.ts` importa de `./security.ts` self-contained (no `../../src`). `BASH_SENSITIVE_RE` arriba. `OSTACKY_SENSITIVE_PATTERNS` override.
 
 ## Tiered single-source
 
-`src/tiered.ts` único origen de `isTrivial(msg,state)` + `getControllerState(dir)`. `ostacky-plugin.ts` importa de `./tiered.ts` mirror (generado vía `sync-controller-core.ts`), `engram.ts` inlined (misma regex, evita import dinámico). No duplicar regex. Ver `assets/plugins/ostacky-plugin.ts` y `assets/plugins/engram.ts`.
+`src/tiered.ts` único origen de `isTrivial(msg,state)` + `getControllerState(dir)`. `index.ts` importa de `./tiered.ts` mirror (generado vía `sync-controller-core.ts`), `engram.ts` inlined (misma regex, evita import dinámico). No duplicar regex. Ver `assets/plugins/ostacky-controller/` y `assets/plugins/engram.ts`.
 
 ## Controller single-source
 
-`src/controller-core.ts` CANÓNICO para `STATES/TRANSITIONS/DEFAULT_STATE`; mirrors generados en `assets/plugins/controller-core.ts` (TS) y `assets/mcp/ostacky-controller/controller-core.js` (JS strippado) vía `bun run scripts/sync-controller-core.ts` (prebuild). No editar mirrors. `ostacky-plugin.ts` importa de `./controller-core.ts` self-contained.
+`src/controller-core.ts` CANÓNICO para `STATES/TRANSITIONS/DEFAULT_STATE`; mirrors generados en `assets/plugins/ostacky-controller/controller-core.ts` (TS) y `assets/mcp/ostacky-controller/controller-core.js` (JS strippado) vía `bun run scripts/sync-controller-core.ts` (prebuild). No editar mirrors. `index.ts` importa de `./controller-core.ts` self-contained. Import siempre `./security.ts` (el server V2 no resuelve `.js→.ts`).
 
 ## Prompt-efficiency
 

package/assets/mcp/ostacky-controller/index.js

@@ -411,6 +411,22 @@ function fastFingerprint(filePath) {
     }
 }
 
+// Refresh honesto sin churn: resuelve a absoluto vía projectRoot para no depender de cwd.
+// Usado por stale-checks, complete_task y refreshFingerprint (fix post-complete refine).
+function fingerprintFor(filePath, statePath) {
+    try {
+        if (!filePath) return null;
+        const projectRoot = getProjectRoot(statePath);
+        const abs =
+            filePath.startsWith('/') || /^[A-Za-z]:/.test(filePath)
+                ? resolve(filePath)
+                : resolve(projectRoot, filePath);
+        return fastFingerprint(abs);
+    } catch {
+        return null;
+    }
+}
+
 class OstackyController {
     #statePath;
     #state;
@@ -1697,14 +1713,14 @@ class OstackyController {
         try {
             for (const [taskId, info] of Object.entries(this.#state.tasks || {})) {
                 if (info.status !== 'COMPLETED' || !info.filePath || !info.fileHash) continue;
-                const current = fastFingerprint(info.filePath);
+                const current = fingerprintFor(info.filePath, this.#statePath);
                 if (!current) staleFiles.push(`${taskId}:${info.filePath} (missing)`);
                 else if (current !== info.fileHash) staleFiles.push(`${taskId}:${info.filePath} (stale fingerprint)`);
                 seenFp2.add(info.filePath);
             }
             for (const [fp, stored] of Object.entries(this.#state.fileFingerprints || {})) {
                 if (seenFp2.has(fp)) continue;
-                const cur = fastFingerprint(fp);
+                const cur = fingerprintFor(fp, this.#statePath);
                 if (!cur) staleFiles.push(`${fp} (missing)`);
                 else if (cur !== stored) staleFiles.push(`${fp} (stale fingerprint)`);
             }
@@ -1764,7 +1780,7 @@ class OstackyController {
                 verificationFailed: verificationFailed.length ? verificationFailed : undefined,
                 current_state: this.#state.state,
                 attempted_transition: 'implementation_complete',
-                suggestion: `${detail} Completá cada task con Read fresco → validate_edit → edit → complete_task (con verificación) y luego reintentá implementation_complete sin force. Solo si querés descartar trabajo pendiente, escribí literal "confirmo forzar" en tu mensaje y reintentá con {force:true}. No propongo cancelar; propongo completar.`,
+                suggestion: `${detail} Si refinaste archivos tras el complete (fingerprint stale), llamá refresh_fingerprint({filePath}) por cada archivo y reintentá implementation_complete sin force. Solo si hay edición real pendiente: Read fresco → validate_edit → edit → complete_task. Solo si querés descartar trabajo pendiente, escribí literal "confirmo forzar" en tu mensaje y reintentá con {force:true}. No propongo cancelar; propongo completar.`,
             };
         }
         if (hasBlocking && force) {
@@ -1785,7 +1801,7 @@ class OstackyController {
                     verificationFailed: verificationFailed.length ? verificationFailed : undefined,
                     current_state: this.#state.state,
                     attempted_transition: 'implementation_complete',
-                    suggestion: `${detail} Para forzar el cierre, escribí literal "confirmo forzar" en tu mensaje (quedará auditado) y reintentá con {force:true}. Si no querés forzar, completá los pendientes y reintentá sin force.`,
+                    suggestion: `${detail} Para forzar el cierre, escribí literal "confirmo forzar" en tu mensaje (quedará auditado) y reintentá con {force:true}. Si no querés forzar y es solo stale por refino, llamá refresh_fingerprint({filePath}) y reintentá sin force.`,
                 };
             }
             const all = [...pending, ...staleFiles, ...verificationFailed].join(',');
@@ -1969,14 +1985,14 @@ class OstackyController {
         try {
             for (const [taskId, info] of Object.entries(this.#state.tasks || {})) {
                 if (info.status !== 'COMPLETED' || !info.filePath || !info.fileHash) continue;
-                const current = fastFingerprint(info.filePath);
+                const current = fingerprintFor(info.filePath, this.#statePath);
                 if (!current) staleFiles.push(`${taskId}:${info.filePath} (missing)`);
                 else if (current !== info.fileHash) staleFiles.push(`${taskId}:${info.filePath} (stale fingerprint)`);
                 seenFp.add(info.filePath);
             }
             for (const [fp, stored] of Object.entries(this.#state.fileFingerprints || {})) {
                 if (seenFp.has(fp)) continue;
-                const current = fastFingerprint(fp);
+                const current = fingerprintFor(fp, this.#statePath);
                 if (!current) staleFiles.push(`${fp} (missing)`);
                 else if (current !== stored) staleFiles.push(`${fp} (stale fingerprint)`);
             }
@@ -2448,11 +2464,11 @@ class OstackyController {
         }
         if (!this.#state.tasks) this.#state.tasks = {};
 
-        // O6: Use fast fingerprint if no hash provided
-        const effectiveHash = fileHash || (filePath ? fastFingerprint(filePath) : null);
+        // O6: Use fast fingerprint if no hash provided (absoluto vía projectRoot)
+        const effectiveHash = fileHash || (filePath ? fingerprintFor(filePath, this.#statePath) : null);
         // 1.6: fingerprint obligatorio si archivo existe
         if (filePath) {
-            const existsCheck = fastFingerprint(filePath);
+            const existsCheck = fingerprintFor(filePath, this.#statePath);
             if (existsCheck && !effectiveHash) {
                 return { error: 'fingerprint required: file exists but fileHash is null' };
             }
@@ -2561,6 +2577,58 @@ class OstackyController {
         };
     }
 
+    /**
+     * Refresh honesto sin churn: re-sincroniza fingerprints con disco tras refino
+     * post-complete. Vale para SPEC y DIRECT, en EXECUTING_INLINE, EXECUTING_SUBAGENTS
+     * y SPECIFICATION. No exige oldString/newString ni reeditar.
+     */
+    async refreshFingerprint({ filePath, taskId } = {}) {
+        this.#load();
+        const allowed = ['EXECUTING_INLINE', 'EXECUTING_SUBAGENTS', 'SPECIFICATION'];
+        if (!allowed.includes(this.#state.state)) {
+            return { error: `Cannot refresh fingerprint from state ${this.#state.state}`, ok: false };
+        }
+        if (taskId && !isValidTaskId(taskId)) return { error: `invalid taskId: ${taskId}`, ok: false };
+        let target = filePath || null;
+        if (!target && taskId && this.#state.tasks?.[taskId]?.filePath) {
+            target = this.#state.tasks[taskId].filePath;
+        }
+        if (!target) return { error: 'filePath or taskId with file is required', ok: false };
+        if (!isPathInsideProject(target, this.#statePath)) {
+            return { error: `filePath outside projectRoot: ${target}`, ok: false, filePath: target };
+        }
+        if (this.isSensitiveFile(target) && !this.#state.allowedFiles?.[target]) {
+            return { error: `BLOCKED: File ${target} requires check_file_access`, ok: false, filePath: target };
+        }
+        const projectRoot = getProjectRoot(this.#statePath);
+        const abs =
+            target.startsWith('/') || /^[A-Za-z]:/.test(target) ? resolve(target) : resolve(projectRoot, target);
+        if (!existsSync(abs)) return { error: `file not found: ${target}`, ok: false, filePath: target };
+        const current = fingerprintFor(target, this.#statePath);
+        if (!current) return { error: `cannot fingerprint: ${target}`, ok: false, filePath: target };
+        const updatedTasks = [];
+        if (!this.#state.fileFingerprints) this.#state.fileFingerprints = {};
+        this.#state.fileFingerprints[target] = current;
+        if (taskId && this.#state.tasks?.[taskId]) {
+            this.#state.tasks[taskId].fileHash = current;
+            if (!this.#state.tasks[taskId].filePath) this.#state.tasks[taskId].filePath = target;
+            updatedTasks.push(taskId);
+        }
+        for (const [tid, info] of Object.entries(this.#state.tasks || {})) {
+            if (info.filePath === target && !updatedTasks.includes(tid)) {
+                info.fileHash = current;
+                updatedTasks.push(tid);
+            }
+        }
+        await this.#persist();
+        await this.#audit(
+            'EXECUTING',
+            'refresh_fingerprint',
+            `filePath=${target} tasks=${updatedTasks.join(',') || '-'}`
+        );
+        return { ok: true, filePath: target, fingerprint: current, updatedTasks };
+    }
+
     async verifyTask({ taskId, filePath: filePathParam } = {}) {
         this.#load();
         if (!taskId) return { error: 'taskId required' };
@@ -2785,7 +2853,7 @@ function safeHandler(fn, options = {}) {
 
 const server = new McpServer({
     name: 'ostacky-controller',
-    version: '0.9.1',
+    version: '0.9.3',
 });
 
 server.registerTool(
@@ -3326,6 +3394,23 @@ server.registerTool(
     })
 );
 
+server.registerTool(
+    'refresh_fingerprint',
+    {
+        description:
+            'Re-sincroniza fingerprints con disco tras refino post-complete, sin reeditar. ' +
+            'Vale para SPEC y DIRECT, en EXECUTING_INLINE, EXECUTING_SUBAGENTS y SPECIFICATION.',
+        inputSchema: z.object({
+            filePath: z.string().optional().describe('File path refinado tras complete.'),
+            taskId: z.string().optional().describe('Task ID (si se omite filePath se usa su archivo).'),
+        }),
+    },
+    safeHandler(async ({ filePath, taskId }) => {
+        log('tool:refresh_fingerprint', { filePath, taskId });
+        return await controller.refreshFingerprint({ filePath, taskId });
+    })
+);
+
 /**
  * Graceful shutdown: clean up tmp/lock files and flush state.
  */
@@ -3357,7 +3442,7 @@ function setupGracefulShutdown(ctrl) {
 }
 
 async function main() {
-    log('Starting ostacky-controller MCP v0.9.1...');
+    log('Starting ostacky-controller MCP v0.9.3...');
     log('State path:', { path: statePath });
     // Clean up stale tmp/lock files from previous runs
     cleanupTmpFiles(statePath);

package/assets/mcp/ostacky-controller/package.json

@@ -1,6 +1,6 @@
 {
     "name": "ostacky-controller",
-    "version": "0.9.1",
+    "version": "0.9.3",
     "private": true,
     "type": "module",
     "dependencies": {

package/assets/plugins/engram.ts

@@ -14,7 +14,10 @@
  *   hooks (event.sessionID) rather than relying on a session.created event.
  */
 
-import { Plugin } from "@opencode/plugin"
+// NOTA: sin `import { Plugin }` runtime a propósito — el server V2 no resuelve
+// `@opencode/plugin` desde `.opencode/plugins/` y `Plugin.define()` es
+// passthrough ({id, setup}). `import type` se borra al transpilar.
+import type { Plugin } from "@opencode/plugin"
 import { join, dirname, basename, delimiter } from "node:path"
 import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync } from "node:fs"
 import { spawn, spawnSync } from "node:child_process"
@@ -197,7 +200,8 @@ function stripJsoncComments(text: string): string {
 
 // ─── Plugin ──────────────────────────────────────────────────────────────────
 
-export default Plugin.define({
+// Objeto literal directo (ver nota en imports).
+export default {
   id: "engram",
   async setup(ctx) {
     const directory = ctx.location.directory
@@ -645,4 +649,4 @@ export default Plugin.define({
 
     return () => eventController.abort()
   },
-})
+}

package/assets/plugins/{ostacky-plugin.ts → ostacky-controller/index.ts}

@@ -11,7 +11,11 @@
  * CodeGraph preventivo: bloquea Read/Grep masivo sin Discovery hit.
  */
 
-import { Plugin } from "@opencode/plugin"
+// NOTA: sin `import { Plugin } from "@opencode/plugin"` a propósito — el server
+// V2 no resuelve ese paquete desde `.opencode/plugins/` (Die ResolveMessage) y
+// `Plugin.define()` es passthrough ({id, setup}). Objeto literal + `import type`
+// (solo tipos, borrado al transpilar) cargan sin dependencias externas.
+import type { Plugin } from "@opencode/plugin"
 import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync, statSync, readdirSync, unlinkSync } from "node:fs"
 import { join, dirname, basename, resolve, relative, delimiter } from "node:path"
 import { SENSITIVE_DEFAULT, BASH_SENSITIVE_RE, isSensitive, extractPathsFromBash } from "./security.ts"
@@ -178,7 +182,9 @@ function extractPathsFromPatch(patchText: string): string[] {
 
 // ─── Plugin ──────────────────────────────────────────────────────────────────
 
-export default Plugin.define({
+// Objeto literal directo (ver nota en imports): el server V2 acepta
+// `{ id, setup }` sin pasar por `Plugin.define()`.
+export default {
   id: "ostacky-controller",
   async setup(ctx) {
     const directory = ctx.location.directory
@@ -374,9 +380,27 @@ export default Plugin.define({
         const isCodeFile = /\.(ts|js|tsx|jsx|mts|cts)$/i.test(targetPath) || targetPath.includes("src/") || targetPath.includes("assets/") || args?.pattern?.includes("*.ts")
         // harden-task-integrity 1.3: eximir reads de tasks.md del gate (no requiere CodeGraph)
         const isSpecTasksPath = targetPath.includes("openspec/changes") || targetPath.includes("openspec/specs")
+        // Docs y markdown nunca son código: no exigir Discovery (fix over-blocking assets/docs)
+        const isDocsPath = targetPath.includes("assets/docs") || targetPath.includes("/docs/") || /\.md$/i.test(targetPath) || /\.json$/i.test(targetPath)
         // Grep on *.md should not be blocked
         const isLiteralGrep = tool === "grep" && (args?.include?.endsWith(".md") || args?.include?.endsWith(".json"))
-        if (isCodeFile && !isLiteralGrep && !isSpecTasksPath) {
+        // Refresh honesto: revalidación post-complete necesita Read fresco sin Discovery hit.
+        // Vale para SPEC y DIRECT, INLINE y SUBAGENTS: si el path está trackeado en
+        // tasks/fileFingerprints/lastValidated, no exigir Discovery.
+        let isTaskTracked = false
+        try {
+          const st = freshState
+          if (st && targetPath) {
+            const fps = Object.keys(st.fileFingerprints || {})
+            const taskFiles = Object.values(st.tasks || {}).map((t: any) => t.filePath).filter(Boolean)
+            const lvFile = (st.lastValidated as any)?.filePath || null
+            isTaskTracked =
+              fps.some((fp) => targetPath.endsWith(fp) || fp.endsWith(targetPath) || targetPath.includes(fp) || fp.includes(targetPath)) ||
+              taskFiles.some((fp: string) => targetPath.endsWith(fp) || fp.endsWith(targetPath) || targetPath.includes(fp) || fp.includes(targetPath)) ||
+              (lvFile ? targetPath.endsWith(lvFile) || lvFile.endsWith(targetPath) : false)
+          }
+        } catch {}
+        if (isCodeFile && !isLiteralGrep && !isSpecTasksPath && !isDocsPath && !isTaskTracked) {
           const hasDiscoveryHit = discoveryHitByRequest.get(sessionId) ?? getDiscoveryCacheHit(directory)
           const codegraphOk = isCodegraphAvailable(directory)
           if (codegraphOk && !hasDiscoveryHit) {
@@ -420,7 +444,9 @@ export default Plugin.define({
       // ── 3.5) Shell file-mutation gate (harden-task-integrity: shell mutante requiere validate_edit) ──
       if (tool === "shell" && freshState && ["EXECUTING_INLINE", "EXECUTING_SUBAGENTS"].includes(freshState.state)) {
         const cmdForMutation: string = args?.command || args?.cmd || ""
-        const isMutating = /[>]{1,2}\s*\S+|\bsed\b[^|;]*-i|\btruncate\b|\btee\b|\bcp\s+|\bmv\s+|python.*open.*w/.test(cmdForMutation)
+        // Fix falso positivo: `2>&1`, `1>&2`, `2>/dev/null` son redirects de stderr, no mutación.
+        const cmdSansStderr = cmdForMutation.replace(/2>&1/g, "").replace(/1>&2/g, "").replace(/2>\s*\/dev\/null/g, "")
+        const isMutating = /(^|[^0-9&])>{1,2}\s*(?!&)\S+|\bsed\b[^|;]*-i|\btruncate\b|\btee\b|\bcp\s+|\bmv\s+|python.*open.*w/.test(cmdSansStderr)
         if (isMutating) {
           const mPaths = extractPathsFromBash(cmdForMutation)
           for (const p of mPaths) {
@@ -711,4 +737,4 @@ export default Plugin.define({
       eventController.abort()
     }
   },
-})
+}

package/assets/plugins/{tiered.ts → ostacky-controller/tiered.ts}

@@ -6,7 +6,7 @@
 /**
  * Tiered helpers — single source of truth for trivial detection y niveles.
  *
- * Ambos plugins (ostacky-plugin.ts y engram.ts) importan de acá.
+ * Consumido por el plugin ostacky-controller/index.ts y engram.ts (mirror en package dir).
  * No duplicar regex. Cache-friendly: isTrivial no muta system[0], solo decide hint.
  * LEVEL_THRESHOLDS es la única definición de niveles (D6).
  */

package/dist/cli.js

@@ -621,31 +621,31 @@ var init_fs = __esm(() => {
 var manifest_default;
 var init_manifest = __esm(() => {
   manifest_default = {
-    version: "0.9.1",
+    version: "0.9.3",
     repo: "JaimeHoracio/Ostacky",
-    tag: "v0.9.1",
+    tag: "v0.9.3",
     agents: [
       {
         name: "ostacky",
         file: "assets/agents/ostacky.md",
-        description: "Orquestador con recuperación automática (nunca se congela), ruteo por nivel de impacto, controller MCP con SDK oficial, edición segura con fallback inline, y delegación en OpenSpec + Superpowers. v0.9.1: prune de skills obsoletas, lastHandoff, getAvailableTransitions, consecutiveFailures real, mem_session_summary automático al cierre.",
-        version: "0.9.1",
-        sha256: "8186994cc9d92585310d8f4c67255e5169f1f3b3d7fc5b3563c2fa79f1203d24"
+        description: "Orquestador con recuperación automática (nunca se congela), ruteo por nivel de impacto, controller MCP con SDK oficial, edición segura con fallback inline, y delegación en OpenSpec + Superpowers. v0.9.3: prune de skills obsoletas, lastHandoff, getAvailableTransitions, consecutiveFailures real, mem_session_summary automático al cierre.",
+        version: "0.9.3",
+        sha256: "51f1deb14c75c5c0b25a77d8ec871e951b4341e4658a735967ba1143baa72f9f"
       }
     ],
     commands: [
       {
         name: "install-stack",
         file: "assets/commands/install-stack.md",
-        description: "Instala el stack tecnológico del proyecto (CodeGraph, skills, OpenSpec, Engram, controller plugin). v0.9.1: controller plugin como alma hard-gate, Context7 removido del stack.",
-        version: "0.9.1",
-        sha256: "af62710619308920f7be8743ed43c726d3591ba2af6535c3cc3ca6db95ad9715"
+        description: "Instala el stack tecnológico del proyecto (CodeGraph, skills, OpenSpec, Engram, controller plugin). v0.9.3: controller plugin como alma hard-gate, Context7 removido del stack.",
+        version: "0.9.3",
+        sha256: "ccc065dd11b53b1c77acafa86ef9dbf65df8ed3f217193901f8b7818447418c1"
       },
       {
         name: "opsx-sync",
         file: "assets/commands/opsx-sync.md",
         description: "Sincroniza delta specs del change activo sin inicializar CodeGraph si ya existe índice",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "fe0158478f2ca63b315037a85fc1632b77868532e319af6c7384285441767d64"
       }
     ],
@@ -653,15 +653,15 @@ var init_manifest = __esm(() => {
       {
         name: "ostacky-controller",
         file: "assets/mcp/ostacky-controller/",
-        description: "Máquina de estados persistida con @modelcontextprotocol/server SDK. v0.9.1: 22 tools (incluye set_handoff, get_handoff, clear_handoff, get_available_transitions funcional). Bugfixes: consecutiveFailures real, lastHandoff state, defaultChoice persistido. Robustez: degraded mode automático tras 3 fallos, persistence condicional para Nivel 0, prune de skills obsoletas.",
-        version: "0.9.1",
-        sha256: "d5d4712e5d823186c267f63cea776feddec4700f1b15286796586efb60c65241"
+        description: "Máquina de estados persistida con @modelcontextprotocol/server SDK. v0.9.3: 22 tools (incluye set_handoff, get_handoff, clear_handoff, get_available_transitions funcional). Bugfixes: consecutiveFailures real, lastHandoff state, defaultChoice persistido. Robustez: degraded mode automático tras 3 fallos, persistence condicional para Nivel 0, prune de skills obsoletas.",
+        version: "0.9.3",
+        sha256: "8548f1b13270fbd0fb5e76888c96b38bc39bf0ba3c8b03fbc8196683226eb4b0"
       },
       {
         name: "openspec",
         file: "assets/mcp/openspec/",
         description: "MCP server local para OpenSpec - proposal, apply, archive, sync de cambios",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "fa4be28bfc1e75db8f1a037e2580f04a60066c80e8e5934e90e1041020d04609"
       }
     ],
@@ -670,105 +670,105 @@ var init_manifest = __esm(() => {
         name: "brainstorming",
         file: "assets/skills/brainstorming/SKILL.md",
         description: "Skill unificado de pensamiento con dos modos: creative-design (producción de diseño → transición a implementación directa o openspec-propose) y open-exploration (exploración libre)",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "f1013a86a8f27914d85a716e23c7fd32db1786d93615e8b0834b13d184308549"
       },
       {
         name: "execution-mode-evaluation",
         file: "assets/skills/execution-mode-evaluation/SKILL.md",
         description: "Skill de análisis de modo de ejecución — output reconciliado con controller snapshot contract (recommendation field)",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "2158a6864c0912e868a9d720db7fd79441e6cc298e3320833d2527c9727c852e"
       },
       {
         name: "tdd",
         file: "assets/skills/tdd/SKILL.md",
         description: "Skill de test-driven development (Superpowers)",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "f0ebfbbc43a8868d31a3fd2df37ae7f60fe8add09c6475862395a68269e5ff7f"
       },
       {
         name: "subagent-driven-development",
         file: "assets/skills/subagent-driven-development/SKILL.md",
         description: "Skill de ejecución con subagentes (Superpowers) — ejecuta solo después de confirmación del coordinador Ostacky",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "1a42d714a9a13faf05f0bf7b580e8d837c2e77a5633839542ccce603023419e8"
       },
       {
         name: "dispatching-parallel-agents",
         file: "assets/skills/dispatching-parallel-agents/SKILL.md",
         description: "Skill de dispatch paralelo de agentes (Superpowers)",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "7e7b712ef742d5631e302e6a71583e2bbbd33094da9281abfb84b43505fc3ef1"
       },
       {
         name: "review",
         file: "assets/skills/review/SKILL.md",
         description: "Skill de revisión de código (Superpowers)",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "b19650ed4d1d4d9857a4dd5b7e08e91328a1a1fc9c45bcc2fb600fa9d0213279"
       },
       {
         name: "receiving-code-review",
         file: "assets/skills/receiving-code-review/SKILL.md",
         description: "Skill de recibir y procesar feedback de code review",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "d761e884e71d8d3476ac734d287cae403a4024506a7d12e7361a448217c0a831"
       },
       {
         name: "openspec-propose",
         file: "assets/skills/openspec-propose/SKILL.md",
         description: "Skill de generación de proposal (OpenSpec)",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "6a517f750f24c008208156a2d653e97ed30b1e53878aeac5ce394e573db0678f"
       },
       {
         name: "openspec-apply-change",
         file: "assets/skills/openspec-apply-change/SKILL.md",
         description: "Skill de aplicación de change (OpenSpec)",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "dfc823bf89fc7505e91ab6dee9c1f004be38a410bd3d88fb67b211b1b6cbb1d0"
       },
       {
         name: "openspec-archive-change",
         file: "assets/skills/openspec-archive-change/SKILL.md",
         description: "Skill de archivo de change (OpenSpec)",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "16e4b561de7747283663fed602e506abf502452c49a8d4b86d7a5539c40f0195"
       },
       {
         name: "openspec-explore",
         file: "assets/skills/openspec-explore/SKILL.md",
         description: "Modo explore para OpenSpec — thinking partner para explorar ideas, investigar problemas y clarificar requisitos antes/durante un cambio",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "9eafc3a8c693b8d9916867ef764d49e5222da717fde501c957bb3f6c312d2415"
       },
       {
         name: "using-git-worktrees",
         file: "assets/skills/using-git-worktrees/SKILL.md",
         description: "Skill de uso de git worktrees para aislamiento de trabajo",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "93341bc1b7c053618a8b6dc07e3615b77990d7b549a0201f5835d95fef67ce13"
       },
       {
         name: "using-superpowers",
         file: "assets/skills/using-superpowers/SKILL.md",
         description: "Skill de orquestación de Superpowers skills",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "7e54536f96d2a379185a10bfc1e970850caa2561b6d8aca7080f0defea0381a4"
       },
       {
         name: "writing-skills",
         file: "assets/skills/writing-skills/SKILL.md",
         description: "Skill de creación y edición de skills",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "3d76b906cee518a2b809febb70db95697a35b9f368986bb504b4120c3bfb437a"
       },
       {
         name: "graceful-degradation",
         file: "assets/skills/graceful-degradation/SKILL.md",
         description: "Skill de degradación graceful cuando múltiples tools están indisponibles",
-        version: "0.9.1",
+        version: "0.9.3",
         sha256: "363449bd9e6f800a0a3168667cf78f767fb105d86e4a4adadcc649d418139303"
       }
     ]
@@ -1178,22 +1178,25 @@ function copyEngramPlugin(projectRoot) {
   copyFileSync3(pluginSource, join7(pluginsDir, "engram.ts"));
 }
 function copyOstackyControllerPlugin(projectRoot) {
-  const pluginSource = join7(PACKAGE_ROOT, "assets", "plugins", "ostacky-plugin.ts");
-  const coreSource = join7(PACKAGE_ROOT, "assets", "plugins", "controller-core.ts");
-  const securitySource = join7(PACKAGE_ROOT, "assets", "plugins", "security.ts");
-  const tieredSource = join7(PACKAGE_ROOT, "assets", "plugins", "tiered.ts");
+  const packageSource = join7(PACKAGE_ROOT, "assets", "plugins", "ostacky-controller");
   const pluginsDir = join7(projectRoot, ".opencode", "plugins");
-  if (!existsSync6(pluginSource)) {
-    throw new Error(`Plugin bundleado de OstackyController no encontrado: ${pluginSource}`);
+  const packageDest = join7(pluginsDir, "ostacky-controller");
+  if (!existsSync6(join7(packageSource, "index.ts"))) {
+    throw new Error(`Plugin bundleado de OstackyController no encontrado: ${packageSource}`);
+  }
+  mkdirSync4(packageDest, { recursive: true });
+  for (const f of ["index.ts", "controller-core.ts", "security.ts", "tiered.ts"]) {
+    const src = join7(packageSource, f);
+    if (existsSync6(src))
+      copyFileSync3(src, join7(packageDest, f));
+  }
+  for (const f of ["ostacky-plugin.ts", "controller-core.ts", "security.ts", "tiered.ts"]) {
+    const legacy = join7(pluginsDir, f);
+    try {
+      if (existsSync6(legacy))
+        rmSync4(legacy, { force: true });
+    } catch {}
   }
-  mkdirSync4(pluginsDir, { recursive: true });
-  copyFileSync3(pluginSource, join7(pluginsDir, "ostacky-plugin.ts"));
-  if (existsSync6(coreSource))
-    copyFileSync3(coreSource, join7(pluginsDir, "controller-core.ts"));
-  if (existsSync6(securitySource))
-    copyFileSync3(securitySource, join7(pluginsDir, "security.ts"));
-  if (existsSync6(tieredSource))
-    copyFileSync3(tieredSource, join7(pluginsDir, "tiered.ts"));
 }
 function buildEngramDownloadUrl(tag, platform = process.platform, arch = process.arch) {
   const target = getEngramReleaseTarget(platform, arch);
@@ -1506,6 +1509,23 @@ function uninstallStackConfig(paths) {
       removed.push(".opencode/tools/");
     } catch {}
   }
+  const ownedPlugins = [
+    "ostacky-controller",
+    "engram.ts",
+    "ostacky-plugin.ts",
+    "controller-core.ts",
+    "security.ts",
+    "tiered.ts"
+  ];
+  for (const name of ownedPlugins) {
+    const p = join7(paths.plugins, name);
+    if (existsSync6(p)) {
+      try {
+        rmSync4(p, { recursive: true, force: true });
+        removed.push(`.opencode/plugins/${name}`);
+      } catch {}
+    }
+  }
   if (removed.length === 0) {
     return { success: true, message: "No había configuración del stack para remover" };
   }
@@ -1522,13 +1542,15 @@ var init_stack = __esm(() => {
 });
 
 // src/doctor-v2.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync6, readdirSync as readdirSync3 } from "fs";
 import { join as join10, delimiter, isAbsolute } from "path";
 function checkDoctorV2(projectRoot) {
   const lines = [];
   const cwd = projectRoot;
   const opencodeDir = findOpenCodeDir(cwd) || join10(cwd, ".opencode");
   const pluginPaths = [
+    join10(opencodeDir, "plugins", "ostacky-controller", "index.ts"),
+    join10(cwd, ".opencode", "plugins", "ostacky-controller", "index.ts"),
     join10(opencodeDir, "plugins", "ostacky-plugin.ts"),
     join10(cwd, ".opencode", "plugins", "ostacky-plugin.ts"),
     join10(cwd, "assets", "plugins", "ostacky-plugin.ts")
@@ -1546,6 +1568,33 @@ function checkDoctorV2(projectRoot) {
       lines.push(`⚠️ controller: no se pudo leer ${found}`);
     }
   }
+  const pluginsDir = join10(opencodeDir, "plugins");
+  for (const f of ["controller-core.ts", "security.ts", "tiered.ts"]) {
+    try {
+      const p = join10(pluginsDir, f);
+      if (existsSync8(p) && !readFileSync6(p, "utf-8").includes("export default")) {
+        lines.push(`⚠️ plugins/${f} suelto sin default — el server lo carga como plugin y falla; mové a plugins/ostacky-controller/ o re-corré install (doctor no lo modifica)`);
+      }
+    } catch {}
+  }
+  try {
+    const home = process.env.HOME || process.env.USERPROFILE || "";
+    const globalPlugins = home ? join10(home, ".config", "opencode", "plugins") : "";
+    if (globalPlugins) {
+      let entries = [];
+      try {
+        entries = readdirSync3(globalPlugins).filter((e) => e.endsWith(".ts"));
+      } catch {}
+      for (const e of entries) {
+        try {
+          const src = readFileSync6(join10(globalPlugins, e), "utf-8");
+          if (src.includes("@opencode-ai/") || !src.includes("export default")) {
+            lines.push(`⚠️ global ${e} con formato V1 (@opencode-ai/* o sin default) — no corre en server V2; actualizalo o borralo a mano (doctor no lo modifica)`);
+          }
+        } catch {}
+      }
+    }
+  } catch {}
   const configPath = findOpenCodeConfig(cwd);
   if (!configPath) {
     lines.push("ℹ️ config: no hay opencode.json ni opencode.jsonc");
@@ -1625,7 +1674,7 @@ var init_doctor_v2 = __esm(() => {
 // package.json
 var package_default = {
   name: "ostacky",
-  version: "0.9.1",
+  version: "0.9.3",
   description: "Instalador interactivo de agentes y comandos para OpenCode",
   type: "module",
   bin: {
@@ -1637,13 +1686,7 @@ var package_default = {
     build: "bun build src/cli.ts --target=node --format=esm --outfile dist/cli.js && bun scripts/add-shebang.ts",
     start: "node dist/cli.js",
     test: "bun test",
-    "check:skills": "bun run scripts/check-skill-sync.ts",
-    "check:skills:fix": "bun run scripts/check-skill-sync.ts --fix",
-    "hash:check": "bun run scripts/update-manifest-hashes.ts --check",
-    "hash:update": "bun run scripts/update-manifest-hashes.ts",
-    "manifest:prepare": "bun run scripts/update-manifest-hashes.ts",
-    "manifest:check": "bun run scripts/update-manifest-hashes.ts --check",
-    prepublishOnly: "bun run scripts/sync-controller-core.ts && bun run manifest:prepare && bun run build"
+    update: "bun run scripts/check-skill-sync.ts && bun run scripts/sync-controller-core.ts && bun run scripts/update-manifest-hashes.ts"
   },
   files: [
     "dist/",
@@ -2804,7 +2847,7 @@ async function probeMcpServer(nodeExecutable, serverPath, cwd, statePath, option
         params: {
           protocolVersion: "2025-03-26",
           capabilities: {},
-          clientInfo: { name: "ostacky-installer", version: "0.9.1" }
+          clientInfo: { name: "ostacky-installer", version: "0.9.3" }
         }
       });
     });
@@ -3145,6 +3188,12 @@ function uninstallAll(paths) {
       } catch {}
     }
   }
+  const packageDir = join6(paths.plugins, "ostacky-controller");
+  if (existsSync5(packageDir)) {
+    try {
+      rmSync3(packageDir, { recursive: true, force: true });
+    } catch {}
+  }
   clearLockfile(paths.root);
 }
 
@@ -3377,13 +3426,17 @@ async function doInstallAll(manifest, paths) {
     const { join } = await import("path");
     await Promise.resolve().then(() => init_github());
     const { findProjectRoot } = await Promise.resolve().then(() => (init_fs(), {}));
-    const src = join(PACKAGE_ROOT, "assets", "plugins", "ostacky-plugin.ts");
-    const dest = join(paths.plugins, "ostacky-plugin.ts");
-    if (existsSync(src)) {
-      mkdirSync(paths.plugins, { recursive: true });
-      copyFileSync(src, dest);
+    const packageSrc = join(PACKAGE_ROOT, "assets", "plugins", "ostacky-controller");
+    const packageDest = join(paths.plugins, "ostacky-controller");
+    if (existsSync(join(packageSrc, "index.ts"))) {
+      mkdirSync(packageDest, { recursive: true });
+      for (const f of ["index.ts", "controller-core.ts", "security.ts", "tiered.ts"]) {
+        const s = join(packageSrc, f);
+        if (existsSync(s))
+          copyFileSync(s, join(packageDest, f));
+      }
     }
-    for (const legacy of ["ostacky-guard.ts", "ostacky-controller.ts"]) {
+    for (const legacy of ["ostacky-plugin.ts", "controller-core.ts", "security.ts", "tiered.ts", "ostacky-guard.ts", "ostacky-controller.ts"]) {
       const lp = join(paths.plugins, legacy);
       if (existsSync(lp))
         try {
@@ -4412,7 +4465,7 @@ async function runUninstallMcpCommand(name, scope) {
 
 // src/cli.ts
 init_fs();
-import { existsSync as existsSync9, statSync as statSync3, readFileSync as readFileSync7, readdirSync as readdirSync3 } from "node:fs";
+import { existsSync as existsSync9, statSync as statSync3, readFileSync as readFileSync7, readdirSync as readdirSync4 } from "node:fs";
 import { join as join11, dirname as dirname8 } from "node:path";
 var HELP = `
 ostacky — Instalador de agentes, comandos, skills y MCPs para OpenCode
@@ -4500,6 +4553,9 @@ async function runDoctorCommand() {
     }
   };
   const pluginPaths = [
+    join11(cwd, "assets", "plugins", "ostacky-controller", "index.ts"),
+    join11(opencodeDir, "plugins", "ostacky-controller", "index.ts"),
+    join11(cwd, ".opencode", "plugins", "ostacky-controller", "index.ts"),
     join11(cwd, "assets", "plugins", "ostacky-plugin.ts"),
     join11(opencodeDir, "plugins", "ostacky-plugin.ts"),
     join11(cwd, ".opencode", "plugins", "ostacky-plugin.ts"),
@@ -4643,7 +4699,7 @@ async function runDoctorCommand() {
     if (!existsSync9(cacheDir)) {
       console.log("ℹ️ cache: no cache dir yet (ok)");
     } else {
-      const files = readdirSync3(cacheDir);
+      const files = readdirSync4(cacheDir);
       let total = 0;
       for (const f of files) {
         try {
@@ -4707,7 +4763,7 @@ async function runDoctorCommand() {
     check("honesty: 7 SHALL", hasHonesty);
     if (!hasHonesty)
       console.log("  Expected: ## Principios de honestidad (SHALL) in ostacky.md");
-    const pluginPath = join11(cwd, "assets", "plugins", "ostacky-plugin.ts");
+    const pluginPath = join11(cwd, "assets", "plugins", "ostacky-controller", "index.ts");
     if (existsSync9(pluginPath)) {
       const plugin = readFileSync7(pluginPath, "utf-8");
       const hasSpecGuard = plugin.includes("getDiscoverySnapshot") && plugin.includes("specSnapshot");

package/manifest.json

@@ -1,29 +1,29 @@
 {
-  "version": "0.9.1",
+  "version": "0.9.3",
   "repo": "JaimeHoracio/Ostacky",
-  "tag": "v0.9.1",
+  "tag": "v0.9.3",
   "agents": [
     {
       "name": "ostacky",
       "file": "assets/agents/ostacky.md",
-      "description": "Orquestador con recuperación automática (nunca se congela), ruteo por nivel de impacto, controller MCP con SDK oficial, edición segura con fallback inline, y delegación en OpenSpec + Superpowers. v0.9.1: prune de skills obsoletas, lastHandoff, getAvailableTransitions, consecutiveFailures real, mem_session_summary automático al cierre.",
-      "version": "0.9.1",
-      "sha256": "8186994cc9d92585310d8f4c67255e5169f1f3b3d7fc5b3563c2fa79f1203d24"
+      "description": "Orquestador con recuperación automática (nunca se congela), ruteo por nivel de impacto, controller MCP con SDK oficial, edición segura con fallback inline, y delegación en OpenSpec + Superpowers. v0.9.3: prune de skills obsoletas, lastHandoff, getAvailableTransitions, consecutiveFailures real, mem_session_summary automático al cierre.",
+      "version": "0.9.3",
+      "sha256": "51f1deb14c75c5c0b25a77d8ec871e951b4341e4658a735967ba1143baa72f9f"
     }
   ],
   "commands": [
     {
       "name": "install-stack",
       "file": "assets/commands/install-stack.md",
-      "description": "Instala el stack tecnológico del proyecto (CodeGraph, skills, OpenSpec, Engram, controller plugin). v0.9.1: controller plugin como alma hard-gate, Context7 removido del stack.",
-      "version": "0.9.1",
-      "sha256": "af62710619308920f7be8743ed43c726d3591ba2af6535c3cc3ca6db95ad9715"
+      "description": "Instala el stack tecnológico del proyecto (CodeGraph, skills, OpenSpec, Engram, controller plugin). v0.9.3: controller plugin como alma hard-gate, Context7 removido del stack.",
+      "version": "0.9.3",
+      "sha256": "ccc065dd11b53b1c77acafa86ef9dbf65df8ed3f217193901f8b7818447418c1"
     },
     {
       "name": "opsx-sync",
       "file": "assets/commands/opsx-sync.md",
       "description": "Sincroniza delta specs del change activo sin inicializar CodeGraph si ya existe índice",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "fe0158478f2ca63b315037a85fc1632b77868532e319af6c7384285441767d64"
     }
   ],
@@ -31,15 +31,15 @@
     {
       "name": "ostacky-controller",
       "file": "assets/mcp/ostacky-controller/",
-      "description": "Máquina de estados persistida con @modelcontextprotocol/server SDK. v0.9.1: 22 tools (incluye set_handoff, get_handoff, clear_handoff, get_available_transitions funcional). Bugfixes: consecutiveFailures real, lastHandoff state, defaultChoice persistido. Robustez: degraded mode automático tras 3 fallos, persistence condicional para Nivel 0, prune de skills obsoletas.",
-      "version": "0.9.1",
-      "sha256": "d5d4712e5d823186c267f63cea776feddec4700f1b15286796586efb60c65241"
+      "description": "Máquina de estados persistida con @modelcontextprotocol/server SDK. v0.9.3: 22 tools (incluye set_handoff, get_handoff, clear_handoff, get_available_transitions funcional). Bugfixes: consecutiveFailures real, lastHandoff state, defaultChoice persistido. Robustez: degraded mode automático tras 3 fallos, persistence condicional para Nivel 0, prune de skills obsoletas.",
+      "version": "0.9.3",
+      "sha256": "8548f1b13270fbd0fb5e76888c96b38bc39bf0ba3c8b03fbc8196683226eb4b0"
     },
     {
       "name": "openspec",
       "file": "assets/mcp/openspec/",
       "description": "MCP server local para OpenSpec - proposal, apply, archive, sync de cambios",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "fa4be28bfc1e75db8f1a037e2580f04a60066c80e8e5934e90e1041020d04609"
     }
   ],
@@ -48,105 +48,105 @@
       "name": "brainstorming",
       "file": "assets/skills/brainstorming/SKILL.md",
       "description": "Skill unificado de pensamiento con dos modos: creative-design (producción de diseño → transición a implementación directa o openspec-propose) y open-exploration (exploración libre)",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "f1013a86a8f27914d85a716e23c7fd32db1786d93615e8b0834b13d184308549"
     },
     {
       "name": "execution-mode-evaluation",
       "file": "assets/skills/execution-mode-evaluation/SKILL.md",
       "description": "Skill de análisis de modo de ejecución — output reconciliado con controller snapshot contract (recommendation field)",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "2158a6864c0912e868a9d720db7fd79441e6cc298e3320833d2527c9727c852e"
     },
     {
       "name": "tdd",
       "file": "assets/skills/tdd/SKILL.md",
       "description": "Skill de test-driven development (Superpowers)",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "f0ebfbbc43a8868d31a3fd2df37ae7f60fe8add09c6475862395a68269e5ff7f"
     },
     {
       "name": "subagent-driven-development",
       "file": "assets/skills/subagent-driven-development/SKILL.md",
       "description": "Skill de ejecución con subagentes (Superpowers) — ejecuta solo después de confirmación del coordinador Ostacky",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "1a42d714a9a13faf05f0bf7b580e8d837c2e77a5633839542ccce603023419e8"
     },
     {
       "name": "dispatching-parallel-agents",
       "file": "assets/skills/dispatching-parallel-agents/SKILL.md",
       "description": "Skill de dispatch paralelo de agentes (Superpowers)",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "7e7b712ef742d5631e302e6a71583e2bbbd33094da9281abfb84b43505fc3ef1"
     },
     {
       "name": "review",
       "file": "assets/skills/review/SKILL.md",
       "description": "Skill de revisión de código (Superpowers)",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "b19650ed4d1d4d9857a4dd5b7e08e91328a1a1fc9c45bcc2fb600fa9d0213279"
     },
     {
       "name": "receiving-code-review",
       "file": "assets/skills/receiving-code-review/SKILL.md",
       "description": "Skill de recibir y procesar feedback de code review",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "d761e884e71d8d3476ac734d287cae403a4024506a7d12e7361a448217c0a831"
     },
     {
       "name": "openspec-propose",
       "file": "assets/skills/openspec-propose/SKILL.md",
       "description": "Skill de generación de proposal (OpenSpec)",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "6a517f750f24c008208156a2d653e97ed30b1e53878aeac5ce394e573db0678f"
     },
     {
       "name": "openspec-apply-change",
       "file": "assets/skills/openspec-apply-change/SKILL.md",
       "description": "Skill de aplicación de change (OpenSpec)",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "dfc823bf89fc7505e91ab6dee9c1f004be38a410bd3d88fb67b211b1b6cbb1d0"
     },
     {
       "name": "openspec-archive-change",
       "file": "assets/skills/openspec-archive-change/SKILL.md",
       "description": "Skill de archivo de change (OpenSpec)",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "16e4b561de7747283663fed602e506abf502452c49a8d4b86d7a5539c40f0195"
     },
     {
       "name": "openspec-explore",
       "file": "assets/skills/openspec-explore/SKILL.md",
       "description": "Modo explore para OpenSpec — thinking partner para explorar ideas, investigar problemas y clarificar requisitos antes/durante un cambio",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "9eafc3a8c693b8d9916867ef764d49e5222da717fde501c957bb3f6c312d2415"
     },
     {
       "name": "using-git-worktrees",
       "file": "assets/skills/using-git-worktrees/SKILL.md",
       "description": "Skill de uso de git worktrees para aislamiento de trabajo",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "93341bc1b7c053618a8b6dc07e3615b77990d7b549a0201f5835d95fef67ce13"
     },
     {
       "name": "using-superpowers",
       "file": "assets/skills/using-superpowers/SKILL.md",
       "description": "Skill de orquestación de Superpowers skills",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "7e54536f96d2a379185a10bfc1e970850caa2561b6d8aca7080f0defea0381a4"
     },
     {
       "name": "writing-skills",
       "file": "assets/skills/writing-skills/SKILL.md",
       "description": "Skill de creación y edición de skills",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "3d76b906cee518a2b809febb70db95697a35b9f368986bb504b4120c3bfb437a"
     },
     {
       "name": "graceful-degradation",
       "file": "assets/skills/graceful-degradation/SKILL.md",
       "description": "Skill de degradación graceful cuando múltiples tools están indisponibles",
-      "version": "0.9.1",
+      "version": "0.9.3",
       "sha256": "363449bd9e6f800a0a3168667cf78f767fb105d86e4a4adadcc649d418139303"
     }
   ]

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "ostacky",
-    "version": "0.9.1",
+    "version": "0.9.3",
     "description": "Instalador interactivo de agentes y comandos para OpenCode",
     "type": "module",
     "bin": {
@@ -12,13 +12,7 @@
         "build": "bun build src/cli.ts --target=node --format=esm --outfile dist/cli.js && bun scripts/add-shebang.ts",
         "start": "node dist/cli.js",
         "test": "bun test",
-        "check:skills": "bun run scripts/check-skill-sync.ts",
-        "check:skills:fix": "bun run scripts/check-skill-sync.ts --fix",
-        "hash:check": "bun run scripts/update-manifest-hashes.ts --check",
-        "hash:update": "bun run scripts/update-manifest-hashes.ts",
-        "manifest:prepare": "bun run scripts/update-manifest-hashes.ts",
-        "manifest:check": "bun run scripts/update-manifest-hashes.ts --check",
-        "prepublishOnly": "bun run scripts/sync-controller-core.ts && bun run manifest:prepare && bun run build"
+        "update": "bun run scripts/check-skill-sync.ts && bun run scripts/sync-controller-core.ts && bun run scripts/update-manifest-hashes.ts"
     },
     "files": [
         "dist/",