Resolve bridge manifest commands

Author: SqlRush

docs/cc-100-roadmap.md

@@ -1456,7 +1456,7 @@ M7 补充：terminal input parser 和 configurable keybinding name parser 现在
 - Chrome/computer-use/voice/native integrations。
 - enterprise/gated/platform-specific behavior。
 
-当前状态：已新增 `advanced` settings gate 地基，覆盖 bridge/LSP/telemetry/Chrome/voice/computer-use/native integrations 的独立 bool 开关解析、settings merge、headless `/config show advanced` 和 `/config search` 审计；`advanced.telemetry=true` 时会在 session 目录写入安全摘要 JSONL 诊断事件，记录事件类型、session/model、tool/progress keys、token/compact/error 摘要，不写入用户/助手正文或工具结果内容；`advanced.lsp=true` 时才向模型暴露只读 `LSPDiagnostics` 工具，用于读取 session-scoped diagnostics snapshot，并支持 file/severity/limit 过滤；`advanced.bridge=true` 时会写出 session-scoped bridge manifest，列出 bridge-safe slash/local command 元数据；未启用时仍不注册或泄露 gated 工具 schema。实际 repl bridge server、session websocket/direct connect、LSP server manager、diagnostic producer、telemetry exporter/tracing、Chrome/voice/computer-use/native runtime 仍未完成。
+当前状态：已新增 `advanced` settings gate 地基，覆盖 bridge/LSP/telemetry/Chrome/voice/computer-use/native integrations 的独立 bool 开关解析、settings merge、headless `/config show advanced` 和 `/config search` 审计；`advanced.telemetry=true` 时会在 session 目录写入安全摘要 JSONL 诊断事件，记录事件类型、session/model、tool/progress keys、token/compact/error 摘要，不写入用户/助手正文或工具结果内容；`advanced.lsp=true` 时才向模型暴露只读 `LSPDiagnostics` 工具，用于读取 session-scoped diagnostics snapshot，并支持 file/severity/limit 过滤；`advanced.bridge=true` 时会写出 session-scoped bridge manifest，列出 bridge-safe slash/local command 元数据，并提供 command/display/alias 安全解析；未启用时仍不注册或泄露 gated 工具 schema。实际 repl bridge server、session websocket/direct connect、LSP server manager、diagnostic producer、telemetry exporter/tracing、Chrome/voice/computer-use/native runtime 仍未完成。
 
 ## Recommended Next Steps
 

docs/claude-code-go-rewrite-plan.md

@@ -745,7 +745,7 @@ test/parity/                 # golden tests against TS/official behavior
 - 每个 gated feature 独立开关测试。
 - 不启用 feature 时二进制行为和可见 schema 不泄露 gated 工具/命令。
 
-- 本轮补充：新增 `advanced` settings gate 地基，覆盖 bridge/LSP/telemetry/Chrome/voice/computer-use/native integrations 的独立 bool 开关解析、settings merge、headless `/config show advanced` 和 `/config search` 审计；`advanced.telemetry=true` 时会在 session 目录写入安全摘要 JSONL 诊断事件，记录事件类型、session/model、tool/progress keys、token/compact/error 摘要，不写入用户/助手正文或工具结果内容；`advanced.lsp=true` 时才向模型暴露只读 `LSPDiagnostics` 工具，用于读取 session-scoped diagnostics snapshot，并支持 file/severity/limit 过滤；`advanced.bridge=true` 时会写出 session-scoped bridge manifest，列出 bridge-safe slash/local command 元数据；未启用时仍不注册或泄露 gated 工具 schema。实际 repl bridge server、session websocket/direct connect、LSP server manager、diagnostic producer、telemetry exporter/tracing、Chrome/voice/computer-use/native runtime 仍未完成。
+- 本轮补充：新增 `advanced` settings gate 地基，覆盖 bridge/LSP/telemetry/Chrome/voice/computer-use/native integrations 的独立 bool 开关解析、settings merge、headless `/config show advanced` 和 `/config search` 审计；`advanced.telemetry=true` 时会在 session 目录写入安全摘要 JSONL 诊断事件，记录事件类型、session/model、tool/progress keys、token/compact/error 摘要，不写入用户/助手正文或工具结果内容；`advanced.lsp=true` 时才向模型暴露只读 `LSPDiagnostics` 工具，用于读取 session-scoped diagnostics snapshot，并支持 file/severity/limit 过滤；`advanced.bridge=true` 时会写出 session-scoped bridge manifest，列出 bridge-safe slash/local command 元数据，并提供 command/display/alias 安全解析；未启用时仍不注册或泄露 gated 工具 schema。实际 repl bridge server、session websocket/direct connect、LSP server manager、diagnostic producer、telemetry exporter/tracing、Chrome/voice/computer-use/native runtime 仍未完成。
 
 ### M12: Parity hardening
 

internal/bridge/manifest.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
 	"time"
 
 	"ccgo/internal/commands"
@@ -101,3 +102,46 @@ func LoadManifest(path string) (Manifest, error) {
 	}
 	return manifest, nil
 }
+
+func (m Manifest) FindCommand(raw string) (Command, bool) {
+	name := normalizeCommandName(raw)
+	if name == "" {
+		return Command{}, false
+	}
+	for _, command := range m.Commands {
+		if commandMatches(command, name) {
+			return command, true
+		}
+	}
+	return Command{}, false
+}
+
+func (m Manifest) AllowsCommand(raw string) bool {
+	_, ok := m.FindCommand(raw)
+	return ok
+}
+
+func commandMatches(command Command, name string) bool {
+	if strings.EqualFold(command.Name, name) || strings.EqualFold(command.DisplayName, name) {
+		return true
+	}
+	for _, alias := range command.Aliases {
+		if strings.EqualFold(alias, name) {
+			return true
+		}
+	}
+	return false
+}
+
+func normalizeCommandName(raw string) string {
+	raw = strings.TrimSpace(raw)
+	raw = strings.TrimPrefix(raw, "/")
+	if raw == "" {
+		return ""
+	}
+	fields := strings.Fields(raw)
+	if len(fields) == 0 {
+		return ""
+	}
+	return strings.TrimSpace(fields[0])
+}

internal/bridge/manifest_test.go

@@ -62,3 +62,20 @@ func TestWriteAndLoadManifest(t *testing.T) {
 		t.Fatalf("loaded manifest = %#v", loaded)
 	}
 }
+
+func TestManifestFindCommandNormalizesSlashNamesAndAliases(t *testing.T) {
+	manifest := Manifest{Commands: []Command{
+		{Name: "compact", Type: contracts.CommandLocal},
+		{Name: "ask", DisplayName: "Ask", Type: contracts.CommandPrompt, Aliases: []string{"question"}},
+	}}
+	for _, raw := range []string{"/compact now", "compact now", "/question deploy", "Ask"} {
+		if _, ok := manifest.FindCommand(raw); !ok {
+			t.Fatalf("FindCommand(%q) = false", raw)
+		}
+	}
+	for _, raw := range []string{"", "/", "/status", "model opus"} {
+		if manifest.AllowsCommand(raw) {
+			t.Fatalf("AllowsCommand(%q) = true, want false", raw)
+		}
+	}
+}