[luochang212]

Plugin type (required) / 插件类型（必填）

• UI Plugin / 是 UI 插件 — provides MCP Apps interactive pages / 提供 MCP Apps 交互页面
• Standard plugin / 普通插件（非 UI） — does not provide MCP Apps interactive pages / 不提供 MCP Apps 交互页面
• Not applicable / 不适用 — repository-only changes; no plugin content changed / 仅仓库级改动，不涉及插件内容

Affected plugin name(s) / 涉及的插件名称：

autoresearch (Standard plugin)

What / 改动内容

This pull request updates the community plugin autoresearch (registered via #1) from 0.1.0 to 0.2.0 in external_plugins/autoresearch/ and bumps the matching marketplace.json entry. The directory is a full sync of the source repo's plugin/ tree at v0.2.0, including deletions (the retired hooks/permission-gate.ts) and additions (scripts/launcher.mjs, mcp/lib/{bash,frozen,harness,spill}.ts, hooks/examples/before/self-check.sh). No marketplace metadata changes beyond the version; icon and category are unchanged.

本 PR 将社区插件 autoresearch（由 #1 注册）从 0.1.0 更新至 0.2.0，同步 external_plugins/autoresearch/ 全树并升级 marketplace.json 条目版本号。同步包含删除（退役的 hooks/permission-gate.ts）与新增（scripts/launcher.mjs、mcp/lib/{bash,frozen,harness,spill}.ts、hooks/examples/before/self-check.sh）；除版本号外市场元数据不变，图标与 category 不变。

Highlights of 0.1.0 → 0.2.0 (grouped; the source repo tags each fix with the field incident or regression test that motivated it):

• Cross-platform launch: MCP server and hooks now launch via scripts/launcher.mjs with the registered command back to bare node (PATH → nvm → standard install locations, Node ≥ 24 gate, signal exit codes passed through, stdout kept clean for JSON-RPC). This raises the runtime requirement from Node ≥ 22 to Node ≥ 24.
• Harder decision gate: run_experiment persists an observation snapshot and log_experiment must reconcile against it (one successful log per run; a non-crash metric must equal the observed value); checks_failed requires a recent failed checks verdict; secondary-metric constraints now read observed values, not caller transcription; delta in the response anchors to the retained line (the same gate the keep audit enforces).
• Guardrail & loop refinements: frozen benchmark files are created on first use instead of pre-existing; harness edits are recorded as ledger rows; infra failures are separated (asi.infra) and excluded from doom-loop detection; deterministic benchmarks suppress the noise-ratio confidence; keep criterion is aligned to the current-best ratchet across protocol text, audit message, and response.
• Robustness: session-state directories (.zcode) excluded from keep commits and rollbacks; run lifecycle always settles (bounded fallback finalize); git failures fail closed; spill buffer hygiene; JSON-RPC error responses for parse errors and unknown methods; many field-incident regressions covered by tests.
• Dashboards: inline collapsible hypothesis/next-action/rollback reasons, editorial archive, summary edge-case fixes.

0.2.0 主要变更（分组；每个 fix 在源仓库均有对应的现场事故或回归测试记录）：

• 跨平台启动：MCP server 与 hooks 统一经 scripts/launcher.mjs 启动，注册命令回到裸 node（解析顺序 PATH → nvm → 标准安装位，主版本门 Node ≥ 24，signal 退出码透传，stdout 保持 JSON-RPC 纯净）。运行要求从 Node ≥ 22 提升到 Node ≥ 24。
• 更硬的判定门：run_experiment 持久化观测快照，log_experiment 强制对账（一次 run 一次成功落账；非 crash 的 metric 必须等于观测值）；checks_failed 需要最近一次失败判定背书；次级度量约束改读观测值而非调用方转写；响应中的 delta 锚定守擂线（与 keep 审计同一道门）。
• 护栏与循环精化：冻结基准文件改为首次创建放行；harness 编辑入账本（harness_edit/frozen_attempt）；基础设施故障分离（asi.infra）并从 doom-loop 检测中排除；确定性基准抑制噪声比置信度；keep 判据（对当前最优）在协议文本、审计报错与响应三处口径对齐。
• 健壮性：宿主会话目录（.zcode）不再被 keep 提交或回滚波及；run 生命周期必然结算（有界 fallback finalize）；git 故障 fail-closed；溢出缓冲卫生；JSON-RPC 解析失败与未知方法返回标准错误码；大量现场事故均已固化为回归测试。
• Dashboard：假设/下一步/回滚理由行内折叠、编辑存档、汇总边界修复。

Testing / 测试方式

• Plugin's own suite: node --test tests/*.test.ts — 242 pass, 0 fail (7 platform-specific skips), including regressions for each field incident listed above. Source repo CI runs lint + typecheck + tests on ubuntu / macOS / Windows (Node 24).
• Upstream checks from this repo's root: python3 scripts/validate.py — the only 2 problems reported are pre-existing on current main and unrelated (plugins/excalidraw and plugins/openpencil not registered in marketplace.json); nothing about autoresearch. A targeted build_zip of external_plugins/autoresearch (61 files) succeeds; git diff --check clean.
• 插件自带单测 242 pass / 0 fail（7 个平台特有跳过）；上游校验仅剩 main 上与本项目无关的 2 个既有问题；autoresearch 单独构建 zip 通过。

Version and registration / 版本与市场注册

• autoresearch 0.2.0; version bumped identically in external_plugins/autoresearch/.zcode-plugin/plugin.json and the root marketplace.json entry; 0.1.0 never reused.
• The manifest now also declares "skills": "./skills" (same convention applied to the github plugin earlier).
• 版本双写一致（清单 + 市场条目），manifest 新增 "skills": "./skills" 声明（与此前 github 插件同一约定）。

Dependencies, network, permissions, side effects / 依赖、网络、权限与副作用

• Zero third-party npm dependencies (unchanged): the MCP server and hooks are Node-stdlib TypeScript run by Node's native type stripping. Node ≥ 24 required (was ≥ 22).
• Side effects (unchanged in kind, documented in both READMEs): executes the user's benchmark script (.auto/measure.sh) and correctness checks (.auto/checks.sh); automatic git operations (keep commits, non-keep reverts, .auto/ exempt); installs 4 hooks (Stop continuation, PreToolUse frozen-write guard, UserPromptSubmit memory injection, SessionStart — the PermissionRequest gate from 0.1.0 is removed); export_dashboard serves a local 127.0.0.1 HTTP page; writes .auto/ session state in the project directory. No network access beyond localhost; no model/API keys.
• 零第三方 npm 依赖不变；Node ≥ 24；副作用类型不变（README 已声明），hooks 从 5 个降为 4 个（移除 PermissionRequest 门禁）；除 localhost dashboard 外无网络访问，无模型/API key。

Licensing / 许可与来源

• Unchanged from feat(autoresearch): 注册 autoresearch v0.1.0 自主实验循环插件 #1: plugin MIT; icon is original artwork registered in assets/icon-sources.json; mechanism research credits (karpathy/autoresearch, pi-autoresearch) noted in the READMEs. No new third-party material in this update.
• 与 feat(autoresearch): 注册 autoresearch v0.1.0 自主实验循环插件 #1 一致：插件 MIT；图标为原创并已登记；机制调研致谢见 README；本次更新未引入新第三方素材。

[panda920]

✅ Internal validation passed. A ZCode maintainer will review the change next; after acceptance, release checks run separately and this PR is closed automatically.

[panda920]

✅ Internal validation passed. A ZCode maintainer will review the change next; after acceptance, release checks run separately and this PR is closed automatically.

[panda920]

✅ Internal validation passed. A ZCode maintainer will review the change next; after acceptance, release checks run separately and this PR is closed automatically.