[#841] retire bundled opencode-notify snapshot

packages/ui-mac/electron-builder.config.ts

@@ -97,12 +97,6 @@ const getBase = (appId: string): Configuration => ({
  from: "resources/agents/",
  to: "agents/",
  },
- {
- // REQ-023 T2:vendored 插件(自包含 plugin.js;installVendoredPlugin 复制入 ~/.alpha/plugins,
- // plugin[] 写绝对路径 —— 安装零网络)。
- from: "resources/plugins/",
- to: "plugins/",
- },
  {
  // MIT license/attribution shipped inside the app (B15). Also surfaced natively via
  // app.setAboutPanelOptions in src/main/index.ts.

packages/ui-mac/resources/NOTICE.txt

@@ -39,14 +39,6 @@ Copyright Anthropic, licensed under the Apache License 2.0. Its full license
 text ships alongside it (resources/skills/skill-creator/LICENSE.txt). Source:
 Anthropic's official Claude plugins/skills.
 
---------------------------------------------------------------------------------
-The "opencode-notify" plugin bundled under resources/plugins/opencode-notify
-(plugin.js, vendored verbatim from npm opencode-notify@0.3.1 dist/index.js,
-with its dependency detect-terminal inlined by the upstream build) is licensed
-under the MIT License. The upstream OpenCodeNotifier.app helper binary is NOT
-redistributed here; the plugin uses its built-in osascript fallback.
-
---------------------------------------------------------------------------------
 Third-party components
 --------------------------------------------------------------------------------
 Other bundled components (Electron, SolidJS, and the dependencies declared in the

packages/ui-mac/resources/extension-seed/NOTICE.md

@@ -1,6 +1,6 @@
 # Alpha extension seed — NOTICE / third-party attributions
 
-Generated by `scripts/build-seed-lock.mjs` from stable catalog `2026-07-13.1` (payload sha256 `e1c148c66a107ddca8f71d626ed5af53b639e215b2a328ac502bc87574311b4a`). Do not hand-edit — regenerate instead.
+Generated by `scripts/build-seed-lock.mjs` from stable catalog `2026-08-06.1` (payload sha256 `e37a4cf3142e12169fa5bd0a2b6907189499122f7ae578a22ffa5a731dc1e874`). Do not hand-edit — regenerate instead.
 
 Machine-readable inventory: [`seed.lock.json`](./seed.lock.json) (schema `alpha.extension-seed.lock.v1`; per-asset SPDX license identifiers).
 

packages/ui-mac/resources/extension-seed/extension-seed.snapshot.json

@@ -1,8 +1,8 @@
 {
  "v": 1,
- "catalogVersion": "2026-07-13.1",
- "lockSha256": "d13e1059ac2dba38f2f1082d1e269d0f258c5a89be7d0269b6417f37378bcf56",
- "noticeSha256": "06e1f0a4483fb1ff23c18ead45f9c7458d0ae93e06673077c46b8d01decc4eb1",
+ "catalogVersion": "2026-08-06.1",
+ "lockSha256": "faad19deea09ab8debf93af45fc9bad92a0b52fbda0b6c71ef1b428bd4337af2",
+ "noticeSha256": "4c4e9d0e718e1e1076c8f4e6ac0eac04daa027247ce005e486aabcd2bea911ee",
  "blobCount": 98,
  "blobBytes": 5670465,
  "source": "alpha-web-checkout",

packages/ui-mac/resources/extension-seed/seed.lock.json

@@ -1,12 +1,12 @@
 {
  "schema": "alpha.extension-seed.lock.v1",
  "channel": "stable",
- "catalogVersion": "2026-07-13.1",
+ "catalogVersion": "2026-08-06.1",
  "catalog": {
- "sha256": "fd5dbc78b3524333c8d90966d8ff48b0010b49c7d8d162562fe3059555fdf3d1",
- "bytes": 59591,
- "url": "https://alphacodeone.com/catalog/v1/releases/2026-07-13.1/catalog.json",
- "sigUrl": "https://alphacodeone.com/catalog/v1/releases/2026-07-13.1/catalog.json.sig"
+ "sha256": "e37a4cf3142e12169fa5bd0a2b6907189499122f7ae578a22ffa5a731dc1e874",
+ "bytes": 81682,
+ "url": "https://alphacodeone.com/catalog/v1/releases/2026-08-06.1/catalog.json",
+ "sigUrl": "https://alphacodeone.com/catalog/v1/releases/2026-08-06.1/catalog.json.sig"
  },
  "supportedPlatforms": [
  "darwin-arm64",
@@ -733,4 +733,4 @@
  ]
  }
  ]
-}
+}

packages/ui-mac/src/main/ext-curation-policy.test.ts

@@ -54,14 +54,14 @@ describe("sessionGrantIdsFromEntries(纯判定,fail-closed 采信)", () => {
 })
 
 describe("readSessionGrantIdsSync(同步读链,r1-4:不可判定 ≠ 空集)", () => {
- test("无已验 LKG/v1 缓存 → ok:false(远端状态未知),partialIds = 随包可识别子集(当前随包无 curation → 空)", () => {
+ test("无已验 LKG/v1 缓存 → ok:false(远端状态未知),partialIds = 当前随包可识别子集", () => {
  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "curation-oracle-"))
  try {
  const oracle = readSessionGrantIdsSync(dir, "stable")
  expect(oracle.ok).toBe(false)
  if (!oracle.ok) {
  expect(oracle.reason).toContain("no verified channel LKG")
- expect(oracle.partialIds.size).toBe(0)
+ expect([...oracle.partialIds].sort()).toEqual(["mcp:chrome-devtools", "mcp:markitdown"])
  }
  } finally {
  fs.rmSync(dir, { recursive: true, force: true })

packages/ui-mac/src/main/ext-fs-installer.test.ts

@@ -321,19 +321,14 @@ describe("agentInstallPresent (REQ-100 #354)", () => {
  })
 })
 
-describe("collectVendoredPluginPayload — #378 随包 plugin 载荷收集(只读;CAS 摄取源)", () => {
- test("collects the real bundled plugin dir (byte-exact, POSIX rel paths, plugin.js present)", () => {
- const r = collectVendoredPluginPayload("plugins/opencode-notify", "opencode-notify")
- expect(r.ok).toBe(true)
- if (!r.ok) return
- const js = r.files.find((f) => f.path === "plugin.js")
- expect(js).toBeDefined()
- expect(js!.data.equals(fs.readFileSync(path.join(resourcesRoot(), "plugins", "opencode-notify", "plugin.js")))).toBe(true)
- // 零副作用:资产原样(只读收集)
- expect(fs.existsSync(path.join(resourcesRoot(), "plugins", "opencode-notify", "plugin.js"))).toBe(true)
+describe("collectVendoredPluginPayload — ADR-040 后无随包 plugin 资产", () => {
+ test("the retired bundled asset is absent and cannot be collected", () => {
+ const retired = collectVendoredPluginPayload("plugins/opencode-notify", "opencode-notify")
+ expect(retired.ok).toBe(false)
+ if (!retired.ok) expect(retired.reason).toContain("未随此版本打包")
  })
 
- test("missing asset / unsafe key / unsafe name refused", () => {
+ test("missing asset and unsafe key/name are refused", () => {
  const ghost = collectVendoredPluginPayload("plugins/ghost-plugin", "ghost-plugin")
  expect(ghost.ok).toBe(false)
  if (!ghost.ok) expect(ghost.reason).toContain("未随此版本打包")
@@ -347,25 +342,10 @@ describe("collectVendoredPluginPayload — #378 随包 plugin 载荷收集(只
  if (!drift.ok) expect(drift.reason).toContain("content identity drift")
  })
 
- test("r16:stageVendoredPluginVersioned 走同一收集合同 —— 落盘与收集器逐字节一致、零额外条目;收集器拒即 staging 拒", () => {
- const c = collectVendoredPluginPayload("plugins/opencode-notify", "opencode-notify")
- expect(c.ok).toBe(true)
- if (!c.ok) return
- const s = stageVendoredPluginVersioned("plugins/opencode-notify", "opencode-notify")
- expect(s.ok).toBe(true)
- if (!s.ok) return
- expect(path.dirname(s.dir)).toBe(path.join(alphaDir, "plugins"))
- const walked: string[] = []
- const walk = (rel: string) => {
- for (const n of fs.readdirSync(rel === "" ? s.dir : path.join(s.dir, rel))) {
- const childRel = rel === "" ? n : `${rel}/${n}`
- if (fs.lstatSync(path.join(s.dir, childRel)).isDirectory()) walk(childRel)
- else walked.push(childRel)
- }
- }
- walk("")
- expect(walked.sort()).toEqual(c.files.map((f) => f.path).sort())
- for (const f of c.files) expect(fs.readFileSync(path.join(s.dir, f.path)).equals(f.data)).toBe(true)
+ test("staging cannot revive an absent packaged plugin", () => {
+ const retired = stageVendoredPluginVersioned("plugins/opencode-notify", "opencode-notify")
+ expect(retired.ok).toBe(false)
+ if (!retired.ok) expect(retired.reason).toContain("未随此版本打包")
  const ghost = stageVendoredPluginVersioned("plugins/ghost-plugin", "ghost-plugin")
  expect(ghost.ok).toBe(false)
  if (!ghost.ok) expect(ghost.reason).toContain("未随此版本打包")

packages/ui-mac/src/preload/types.ts

@@ -233,7 +233,7 @@ export type InstallReceipt = {
  origin: InstallReceiptOrigin
  /** absolute paths owned by this install (fs types + bridge symlinks) */
  files?: string[]
- /** config ownership, e.g. "mcp.markitdown" / "plugin:opencode-notify@0.3.1" */
+ /** config ownership, e.g. "mcp.markitdown" / "plugin:example@1.0.0" */
  configKey?: string
 }
 export type InstallLedgerView = { global: InstallReceipt[]; project: InstallReceipt[]; warnings: string[] }