Add Handoff to OpenCode plugin (#6948)

* Add Handoff to OpenCode plugin

Registers handoff-od in the community catalog, pointing at its canonical
repository at github.com/ross-sec/handoff-od@v0.1.3.

Bumps the catalog version and metadata.version 0.2.3 -> 0.2.4.

* Repin community/handoff-od to v0.1.4

Addresses the review on #6948: the pinned v0.1.3 release had an empty-slug
deletion path. A project name written entirely outside [a-z0-9] slugified to "",
so join(outRoot, "") resolved to outRoot itself and --force ran
rmSync(outRoot, { recursive: true, force: true }) against it.

v0.1.4 fixes it in two places — a non-empty deterministic fallback slug, and a
guard that refuses any delete/write target which does not resolve to a strict
descendant of the output root — with regression tests for both. v0.1.3 and
earlier are deprecated on npm.

Catalog version 0.2.4 -> 0.2.5.

* Repin community/handoff-od to v0.1.5

Addresses review round 2 on #6948: the pinned v0.1.4 mirrored symlinks without
classifying them, so a link to a file outside the project copied that file's bytes
into the bundle, and a link to an external directory aborted the mirror with
EISDIR/EPERM.

v0.1.5 adds I9 — nothing outside the project directory is ever mirrored, named or
read — applied to the resolved target: internal links are followed and materialized,
internal-but-excluded links are skipped as their target would be, external and
dangling links are refused and named before anything is written or deleted. Raw path
input (--files, --focus, --entry, designSystem.dir) is checked the same way. Phase 03
asserts the finished bundle contains no symlinks at all.

Fixture coverage for file and directory links with targets inside and outside the
project, as requested. 54 tests, green on Linux and Windows. v0.1.4 and earlier are
deprecated on npm.

Catalog version 0.2.5 -> 0.2.6.

* Repin community/handoff-od to v0.1.6

Addresses review round 3 on #6948: depth=both never placed the authored spec in the
bundle. depth was a declared manifest input that phase 00 wrote into state and no
script read, and the documented order ran phase 01 before phase 02 — so the mirror
was snapshotted before the spec existed and nothing refreshed it.

v0.1.6 reorders the workflow so the authored spec exists before the bundle snapshot,
and enforces it: phase 01 refuses at depth=both until the spec is present and
TODO-free, phase 01 and phase 03 both gate the nested spec, and an end-to-end fixture
reads the finished archive's central directory to prove the spec README and its
prototypes are inside it.

The audit that review prompted found two further declared inputs that did not do what
the manifest advertised — includeChats promised a chats/ directory nothing created,
and transport=both emitted only one prompt. Both fixed, and I10 now asserts every
declared input is wired to behaviour and checked by a gate.

64 tests, green on Linux and Windows. v0.1.5 and earlier are deprecated on npm.

Catalog version 0.2.6 -> 0.2.7.

* Repin community/handoff-od to v0.1.7

Addresses review round 4 on #6948: the phase-03 verdict could outlive the bundle it
described. validate.json carried only ok/root/gates, so a --force rebuild or a
post-validation edit left phase 04 archiving a tree phase 03 never inspected —
skipping root purity, symlink rejection, spec completeness and adherence checks.

v0.1.7 clears the verdict before every bundle mutation and binds a successful verdict
to a content digest of the validated tree, which phase 04 recomputes and refuses on
any difference. Phase 04 additionally reads each archive back and compares its file
entries to the validated set rather than comparing counts, and refuses a bundle
containing symlinks the digest walk would not have seen.

Regression fixtures for both paths the review named: a --force rebuild and a
post-validation mutation each make archive creation fail until phase 03 runs again.

75 tests, green on Linux and Windows. v0.1.6 and earlier are deprecated on npm.

Catalog version 0.2.7 -> 0.2.8.

* Repin community/handoff-od to v0.1.8

Addresses review round 5 on #6948: phase 04 could produce a passing archive whose
bytes were never validated. v0.1.7 hashed the tree before invoking the external
archiver and then checked only the archive's entry names, so a file swapped in between
— by another process in the output tree, or a substituted tool — shipped unvalidated.

v0.1.8 records a per-file sha256 in the phase-03 verdict and has phase 04 decode the
finished archive and compare the hash of every regular file it carries against that
record, reporting missing, unexpected and altered contents separately. A failed
archive is deleted rather than left looking finished. Decoding is in-process so the
check does not depend on the same external tool family that wrote the archive.

Regression fixture as requested: a tar shim ahead of the real one on PATH mutates a
bundle file when phase 04 invokes it, then delegates, placing the mutation after the
pre-archive check and before the archiver reads.

77 tests, green on Linux. v0.1.7 and earlier are deprecated on npm.

Catalog version 0.2.8 -> 0.2.9.

* Repin community/handoff-od to v0.1.9

Addresses review round 6 on #6948: the default ZIP transport required an undeclared
host package. zipStrategies() had no candidate on a Linux box with only GNU tar, so
the default workflow failed at the deliverable with 'no working zip writer. Tried 0'.

v0.1.9 writes both formats in-process with node:zlib. engines: node >= 20 and zero
dependencies are now the whole requirement, and nothing external is invoked — which
also means a substituted archiver on PATH cannot affect the output.

Fixtures as requested: the default pipeline run with PATH pointing at an empty
directory, and a hostile tar/zip/bsdtar earlier on PATH asserted never to execute.
Output verified byte-identical against bsdtar, PowerShell Expand-Archive and Python
zipfile; a pax header now carries non-ASCII and long paths, which ustar mangled.

81 tests, zero skipped. v0.1.8 and earlier are deprecated on npm.

Catalog version 0.2.9 -> 0.2.10.

Author: ross-sec

plugins/registry/community/open-design-marketplace.json

@@ -2,14 +2,14 @@
   "$schema": "https://open-design.ai/schemas/marketplace.v1.json",
   "specVersion": "1.0.0",
   "name": "open-design-community",
-  "version": "0.2.3",
+  "version": "0.2.10",
   "owner": {
     "name": "OpenDesign Community",
     "url": "https://open-design.ai/marketplace/community"
   },
   "metadata": {
     "description": "Default community plugin registry seed. Entries here are discoverable by default but remain restricted until the user installs and trusts them.",
-    "version": "0.2.3"
+    "version": "0.2.10"
   },
   "plugins": [
     {
@@ -111,6 +111,34 @@
         "qa"
       ],
       "description": "Presentation system for agent-made PPTs: AST (audience-state-transfer) outline with per-page media decisions, a production brief for downstream renderers, and a capped 3-round presentation checkup on the rendered deck."
+    },
+    {
+      "name": "community/handoff-od",
+      "title": "Handoff to OpenCode",
+      "version": "0.1.9",
+      "source": "github:ross-sec/handoff-od@v0.1.9",
+      "publisher": {
+        "id": "ross-technologies",
+        "github": "ross-sec",
+        "url": "https://github.com/ross-sec"
+      },
+      "homepage": "https://github.com/ross-sec/handoff-od",
+      "license": "MIT",
+      "capabilitiesSummary": [
+        "prompt:inject",
+        "fs:read",
+        "fs:write",
+        "bash"
+      ],
+      "tags": [
+        "community",
+        "export",
+        "handoff",
+        "opencode",
+        "code-agent",
+        "design-to-code"
+      ],
+      "description": "Hand an Open Design project off to OpenCode as an offline-complete bundle: a verbatim project mirror, the design system materialized with real font binaries, and a machine-enforced adherence config."
     }
   ]
 }