Add plugin cli-agent-bridge - #16

What changes

Adds the hosted Plugin plugins/Hylouis233/cli-agent-bridge: a dependency-free stdio MCP server
and same-name Skill that let MiniMax Code delegate bounded coding tasks to locally installed
Claude Code, Codex CLI, Kimi Code, ZCode, or DSH processes inside a Git repository, then review
the resulting workspace and commit changes.

The server exposes three tools:

• list_backends reports configured CLIs, availability, versions, and experimental notes.
• workspace_status returns a bounded Git snapshot: status, staged/unstaged diff stats, changed
  files (including untracked paths), HEAD and symbolic HEAD, and refs.
• delegate_task runs one backend and returns the exit code, bounded stdout/stderr tails,
  before/after Git snapshots, moved refs, and an attributed commits block. Dirty worktrees are
  rejected unless allowDirty=true; unsupported resume requests fail instead of silently starting
  a fresh session.

Safety and concurrency behavior

• Calls targeting the same Git common directory are serialized across subdirectory aliases,
  symlinks, linked worktrees, independent MCP clients, and bridge processes. Independent clones
  can still run in parallel.
• Coordination state lives in a private bare lock store under the Git common directory; bridge
  refs never enter the target repository and therefore do not leak through git push --mirror.
  The lock store inherits core.sharedRepository and uses compare-and-swap owner records,
  cross-process failed-release recovery, read-only ownership probes, and safe automatic Git
  maintenance.
• Cancellation and the overall deadline cover discovery, lock waits, snapshots, the backend, and
  post-run attribution. Backend process trees, plus descendants spawned by Git hooks/helpers, are
  contained and confirmed terminated before the repository lease is released. Uncertain worker
  termination fails closed behind a shared quarantine marker.
• Git attribution handles unborn HEADs, same-commit symbolic-HEAD changes, force-moved and
  non-commit refs, fetched remote/tag/prefetch history, more than 256 baseline tips, linked
  worktrees, submodules, unusual path bytes, and staged/untracked changes without presenting a
  truncated snapshot as complete.
• The server makes no network calls and stores no credentials or session logs. The selected backend
  CLI uses the user's own authentication and may send task/workspace data to its provider. Private
  coordination records contain process/lease metadata; a quarantine marker persists only when
  manual recovery is required.

User value

MiniMax Code remains the orchestrator while specialized coding CLIs perform self-contained work.
Every result includes reviewable Git evidence instead of relying on copied terminal output.

Example prompt:

Use the cli-agent-bridge skill, then delegate the login-form refactor in this repository to codex.

For independent comparison runs, create separate clean clones at the same starting commit; linked
worktrees intentionally share the repository lock and queue instead of running concurrently.

Requirements and disclosure

• Node.js 20 or newer and Git on PATH; no npm runtime dependencies.
• Windows, Linux, and macOS are supported. Windows shim commands use the bundled PowerShell 5.1
  runner. The implementation is exercised on Windows and Linux; the macOS POSIX path is supported
  but has not been machine-verified in this PR.
• Backend CLIs must already be installed, authenticated, and configured by the user. Claude,
  Codex, and Kimi templates are non-experimental; ZCode and DSH remain explicitly experimental.
• No credentials, installers, native binaries, private endpoints, or telemetry are bundled.

Verification

Verified on current head 6f158b2:

• Linux container npm run check: 107 tests, 104 passed, 3 platform-specific skips, 0 failed.
• Original plugin integration suite (test/server.test.mjs): 11/11 passed, including protocol
  negotiation, tool discovery, untracked files, dirty-tree refusal, unknown backends,
  cancellation, before/after snapshots, same-workspace serialization, queued cancellation,
  unborn HEAD, and Codex option delimiters.
• Targeted Linux fixture proves an escaped fsmonitor-hook descendant is terminated before return.
• Targeted recovery fixture proves a failed release is recoverable through a separately loaded
  module instance with no shared in-memory recovery state; ownership probes do not manufacture
  heartbeat blobs.
• git diff --check is clean.
• GitHub validate, analyze, and CodeQL checks all pass.

Submission checklist

• Plugin path, manifest name, license, examples, requirements, platforms, accounts, network/data
  behavior, and experimental backends are disclosed.
• No scaffold TODOs, credentials, symlinks, installers, or native binaries are included.
• Repository validation and test suites pass on the current head.