360 Secure SkillHub
360 安全技能中心

qoder-delegate

该 Skill 让编排者把一个边界明确的编码任务写成 brief,通过 relay 脚本调用 Qoder CLI 在后台修改工作树,之后由编排者独立重跑项目门禁、审查 diff 并提交。支持模型与上下文窗口选择、会话续接、权限模式与多任务队列;不包含 qodercli 的安装认证,也未验证原生 Windows 启动。

amElnagdy
热度 0.00
最近更新 2026-10-18 16:21:34
分类:开发依赖:代码执行 / 读写文件 / 第三方 API / MCP 服务应用场景:代码生成 / 代码审查 / 工作流 / 任务管理

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add amelnagdy/delegate-skills/qoder-delegate
Metadata
name
qoder-delegate
description
Delegate a coding task to the Qoder CLI (`qodercli`) as a background implementer, then review its diff and land it yourself. Use this whenever the user asks to have Qoder implement, fix, refactor, or run a queue of coding tasks while the orchestrator remains the reviewer. DO NOT USE for tasks small enough to do inline, or when the user wants code written directly without delegation.
license
MIT
metadata
{"version":"0.5.0"}

Qoder Delegate

You are the orchestrator. Delegate one bounded coding task to a separate implementer - Qoder CLI - then review what it produced and land it yourself. You write the brief and own the judgment; Qoder edits the working tree in its session; you verify and commit.

The loop needs only shell and file access, so any comparable orchestrator can drive it.

When NOT to use this

  • The task is small enough to do inline; delegation overhead is not worth it.
  • qodercli is not installed or authenticated.
  • You want to write the code yourself or need only an interactive Qoder session.

Prerequisites (check once)

command -v qodercli
qodercli --version
qodercli --list-models

If the binary is missing, install it from Qoder's official Quick Start. Authenticate with qodercli login, or set QODER_PERSONAL_ACCESS_TOKEN for automation. A successful --list-models confirms the current account can return its live model catalog.

Choose model and context window

Qoder's available models can change. If the human requests a model, use its exact current value from qodercli --list-models; never invent or pin a catalog entry. Otherwise omit --model and let Qoder use its current default.

--context-window <n> is optional. Pass a positive integer only when the human requests a size or the task needs an explicit budget. Qoder applies it only to supported models; surface an unsupported model/size error instead of silently choosing another value.

The loop

Run these five steps per task. Steps 1, 4, and 5 require judgment; 2 and 3 are mechanical.

1. Write the brief

Qoder sees the brief plus what it can inspect in the workspace, not this chat. Include the goal, current state, what to change, what to leave untouched, the project's actual gates, and a closing report contract. Tell Qoder not to commit. Keep one task per brief. See references/writing-the-brief.md.

2. Dispatch

For Codex orchestration of background work, install and configure the separate codex-background support utility first. If its MCP tools or registry are missing, stop and report the setup requirement; do not silently fall back to model-driven polling. Then invoke its registered delegate_run MCP tool once in place of the shell example below. Follow that skill for structured common arguments, unchanged provider flags and reattachment by runId. Keep the request pending until completion, then continue this skill's review and landing steps. Other orchestrators keep the shell workflow below.

Use the bundled relay. It wraps Qoder's non-interactive stream-json mode and writes result.json. <skill-dir> is the installed folder containing this SKILL.md.

node "<skill-dir>/scripts/relay.mjs" --brief brief.txt --cd /path/to/repo
# choose a live model:                 add --model "<value from qodercli --list-models>"
# request a supported context window: add --context-window 32768
# resume the latest session:          add --resume-last  # delta brief only
# resume a specific session:          add --resume <id>  # delta brief only
# see every option:                   node .../relay.mjs --help

Implementation runs default to Qoder's auto permission mode. The relay never bypasses permissions unless the caller explicitly requests it, and it never commits. See references/dispatch-and-poll.md.

3. Wait for completion

Codex using codex-background keeps the original MCP request pending: no model-driven sleep, status or log polling. Use delegate_wait only to reattach after an interrupted request.

The relay blocks until Qoder exits. Run it with the orchestrator's background-command facility, or background it in the shell and wait for result.json. Completion means the process exited and the file contains a status; do not trust a progress display.

A pre-run usage error exits 2 and writes no result. Missing qodercli exits 127 and writes status: "qoder_unavailable" with installation guidance.

Native Windows relay launch is not yet verified; do not claim it until a native Windows smoke passes.

4. Review - do not trust the self-report

Treat Qoder's final message and gate outcomes as claims:

  • Re-run the project's gates yourself.
  • Read the diff against the brief, starting with touchedFiles.
  • Check any --add-dir workspaces separately; their changes are not in the primary tree report.
  • Run relevant guard skills if installed.
  • Round-trip migrations and grep for dangling references after removals or renames.

See references/review-and-land.md.

5. Land it

The implementer edits; the orchestrator commits. Commit only after the gates pass and the diff holds. If rework is needed, send a delta brief with --resume-last or --resume <id>, then review again.

Permission model

Qoder print mode cannot show approval prompts. The relay defaults to auto, which makes non-interactive allow/deny decisions. default can deny actions that would require a prompt; accept_edits permits workspace edits but may deny shell actions; dont_ask fails closed; plan maps to default plus Qoder's Plan work state; and bypass_permissions is for explicitly trusted runs only.

Qoder falls back to default when a non-default mode is requested outside a trusted directory. Check actualPermissionMode in result.json; no requested mode replaces diff review.

Authorization model

Delegation is something the human opts into. Once they ask for it, landing verified, gate-passing work is the contract. Two limits remain: surface, do not absorb (report Qoder's design decisions and non-blocking deviations) and stop for scope changes (ask before expanding beyond the brief). See references/review-and-land.md.

References