@agent-loom/loom 1.0.2 → 1.0.3

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA2CH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,CAAC;AACxE,CAAC;AAOD,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,CAAC;AACxE,CAAC;AAQD,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,UAAU,IAAI,KAAK,CAAC;AAC5E,CAAC;AAmCD,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC;AACzF,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA8CH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,CAAC;AACxE,CAAC;AAOD,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,CAAC;AACxE,CAAC;AAQD,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,UAAU,IAAI,KAAK,CAAC;AAC5E,CAAC;AAkBD,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,UAAU,IAAI,KAAK;QACnB,KAAK,CAAC,OAAO,CAAE,KAA+B,CAAC,QAAQ,CAAC,CACzD,CAAC;AACJ,CAAC;AA2BD,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,UAAU,IAAI,KAAK;QACnB,KAAK,CAAC,OAAO,CAAE,KAA+B,CAAC,QAAQ,CAAC,CACzD,CAAC;AACJ,CAAC;AA6DD,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC;AACzF,CAAC"}

package/dist/util/binary-cache.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Binary cache for MCP servers declared via dobby's `binary:` block.
+ *
+ * Lazy-downloads a release asset from a GitHub release into
+ * ~/.loom/mcp-binaries/<owner>_<repo>/<version>/<filename> on first use.
+ * Subsequent launches reuse the cached file.
+ *
+ * Resolves the {os}, {arch}, {ext} variables in the pattern using the
+ * modern Go-style convention that GitHub Action release uploaders typically
+ * use (windows / linux / darwin x amd64 / arm64). If a manifest in the
+ * wild uses a different convention, we try the alternatives via the
+ * release-asset listing before giving up.
+ *
+ * Auth: when the spec declares auth.type='github' we attach a Bearer
+ * token from `gh auth token`. Public release assets work without auth.
+ *
+ * Security: filename is validated as a basename only (alphanumerics,
+ * dot, underscore, hyphen). No directory separators, no shell metachars.
+ */
+export interface BinarySpec {
+    source: 'github';
+    repo: string;
+    path: string;
+    pattern: string;
+    version: string;
+    auth?: {
+        type: string;
+    };
+}
+export interface BinaryResolveResult {
+    /** Absolute path to the cached binary file. */
+    cachedPath: string;
+    /** Whether the binary was downloaded this call (vs already cached). */
+    downloaded: boolean;
+    /** The resolved asset name on the GitHub release. */
+    assetName: string;
+}
+/**
+ * Resolve a `binary:` spec to a local cached path, downloading from the
+ * GitHub release on cache miss. Returns undefined if resolution fails for
+ * any reason (validation, network, missing asset). Errors are logged
+ * via the `log` callback so the caller can surface them in stderr.
+ */
+export declare function resolveBinaryToCache(binary: BinarySpec, log?: (msg: string) => void): Promise<BinaryResolveResult | undefined>;
+/**
+ * Expand {os}, {arch}, {ext} in a release-asset pattern into a small set
+ * of likely candidates. The canonical convention (windows/linux/darwin x
+ * amd64/arm64) is tried first; we fall back to a couple of legacy aliases
+ * (win, macos, x64) so manifests authored against older binaries still
+ * resolve.
+ */
+export declare function expandPatternVariants(pattern: string): string[];
+//# sourceMappingURL=binary-cache.d.ts.map

package/dist/util/binary-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-cache.d.ts","sourceRoot":"","sources":["../../src/util/binary-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,QAAQ,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAC;IACpB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;CACnB;AAID;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,GACpC,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAwF1C;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA2B/D"}

package/dist/util/binary-cache.js

@@ -0,0 +1,211 @@
+/**
+ * Binary cache for MCP servers declared via dobby's `binary:` block.
+ *
+ * Lazy-downloads a release asset from a GitHub release into
+ * ~/.loom/mcp-binaries/<owner>_<repo>/<version>/<filename> on first use.
+ * Subsequent launches reuse the cached file.
+ *
+ * Resolves the {os}, {arch}, {ext} variables in the pattern using the
+ * modern Go-style convention that GitHub Action release uploaders typically
+ * use (windows / linux / darwin x amd64 / arm64). If a manifest in the
+ * wild uses a different convention, we try the alternatives via the
+ * release-asset listing before giving up.
+ *
+ * Auth: when the spec declares auth.type='github' we attach a Bearer
+ * token from `gh auth token`. Public release assets work without auth.
+ *
+ * Security: filename is validated as a basename only (alphanumerics,
+ * dot, underscore, hyphen). No directory separators, no shell metachars.
+ */
+import { existsSync, mkdirSync, statSync } from 'node:fs';
+import { writeFile, chmod } from 'node:fs/promises';
+import { join } from 'node:path';
+import { platform } from 'node:os';
+import { execSync } from 'node:child_process';
+import { loomHomeDir } from './loom-home.js';
+const FILENAME_RE = /^[A-Za-z0-9._-]+$/;
+/**
+ * Resolve a `binary:` spec to a local cached path, downloading from the
+ * GitHub release on cache miss. Returns undefined if resolution fails for
+ * any reason (validation, network, missing asset). Errors are logged
+ * via the `log` callback so the caller can surface them in stderr.
+ */
+export async function resolveBinaryToCache(binary, log = () => { }) {
+    // Try the canonical Go-style convention first; fall back to legacy
+    // alternatives if the resolved filename doesn't exist as a release asset.
+    const candidates = expandPatternVariants(binary.pattern);
+    // Validate every candidate as a safe basename before attempting any
+    // network call. This closes the same shell-injection / path-traversal
+    // attack surface as the synchronous resolver.
+    for (const filename of candidates) {
+        if (!FILENAME_RE.test(filename)) {
+            log(`  Binary ${binary.repo}: rejecting filename "${filename}" -- pattern must yield a basename (alphanumerics, dot, underscore, hyphen)`);
+            return undefined;
+        }
+    }
+    const repoSlug = binary.repo.replace(/[/\\]/g, '_');
+    const cacheDir = join(loomHomeDir(), 'mcp-binaries', repoSlug, binary.version);
+    mkdirSync(cacheDir, { recursive: true });
+    // Cache hit: any candidate filename present on disk wins.
+    for (const filename of candidates) {
+        const cachedPath = join(cacheDir, filename);
+        if (existsSync(cachedPath) && statSync(cachedPath).size > 0) {
+            log(`  Binary ${binary.repo}: cache hit ${cachedPath}`);
+            return { cachedPath, downloaded: false, assetName: filename };
+        }
+    }
+    // Build candidate URLs. The `binary:` spec describes WHERE the asset lives;
+    // in the wild we see two conventions:
+    //   1. GitHub releases — typical for repos that ship via tagged releases.
+    //      URL: https://github.com/<repo>/releases/download/v<version>/<filename>
+    //   2. Source-tree raw checkout — used when the repo checks binaries into
+    //      a path like `tools/<name>/current/`. The `path:` field in the spec
+    //      points at that directory; the file lives at
+    //      https://raw.githubusercontent.com/<repo>/<ref>/<path>/<filename>
+    //
+    // We try both, with a few likely refs for the raw form. First successful
+    // download (200 status, non-HTML body, valid magic-bytes for .exe) wins.
+    const tag = binary.version.startsWith('v') ? binary.version : `v${binary.version}`;
+    const refsToTry = Array.from(new Set([
+        tag, // 'v1.0.0' (release tag)
+        binary.version, // '1.0.0' (branch / tag without v)
+        'main', // default branch on most repos
+        'master', // older repos
+    ]));
+    const urlCandidates = [];
+    for (const filename of candidates) {
+        // Releases URL: tag-style refs
+        urlCandidates.push({
+            url: `https://github.com/${binary.repo}/releases/download/${tag}/${filename}`,
+            kind: 'release',
+        });
+        // Raw-content URL: each ref + the spec's `path` subdir
+        if (binary.path) {
+            const pathPart = binary.path.replace(/^\/|\/$/g, '');
+            for (const ref of refsToTry) {
+                urlCandidates.push({
+                    url: `https://raw.githubusercontent.com/${binary.repo}/${ref}/${pathPart}/${filename}`,
+                    kind: 'raw',
+                });
+            }
+        }
+    }
+    // Try each candidate URL until one downloads successfully. Each failure
+    // is logged so the user has visibility if every attempt misses.
+    for (const { url } of urlCandidates) {
+        // Filename to cache as: pull from the URL
+        const filename = url.substring(url.lastIndexOf('/') + 1);
+        const cachedPath = join(cacheDir, filename);
+        try {
+            await downloadFile(url, cachedPath, binary.auth?.type === 'github');
+            if (platform() !== 'win32') {
+                await chmod(cachedPath, 0o755);
+            }
+            log(`  Binary ${binary.repo}: downloaded ${filename} -> ${cachedPath}`);
+            return { cachedPath, downloaded: true, assetName: filename };
+        }
+        catch (err) {
+            log(`  Binary ${binary.repo}: ${url} -> ${err.message}`);
+            // Try next URL
+        }
+    }
+    log(`  Binary ${binary.repo}: failed to download from any of ${urlCandidates.length} candidate URLs (tried release tag ${tag} and raw paths under refs ${refsToTry.join(', ')}).`);
+    return undefined;
+}
+/**
+ * Expand {os}, {arch}, {ext} in a release-asset pattern into a small set
+ * of likely candidates. The canonical convention (windows/linux/darwin x
+ * amd64/arm64) is tried first; we fall back to a couple of legacy aliases
+ * (win, macos, x64) so manifests authored against older binaries still
+ * resolve.
+ */
+export function expandPatternVariants(pattern) {
+    const variants = [];
+    const seen = new Set();
+    // Canonical (Go release-uploader) convention
+    const canonicalOs = canonical(['win32', 'windows'], ['darwin', 'darwin'], ['linux', 'linux']);
+    const canonicalArch = process.arch === 'arm64' ? 'arm64' : 'amd64';
+    const ext = platform() === 'win32' ? '.exe' : '';
+    // Legacy aliases (older dobby/loom releases use these)
+    const legacyOs = canonical(['win32', 'win'], ['darwin', 'macos'], ['linux', 'linux']);
+    const legacyArch = process.arch === 'arm64' ? 'arm64' : 'x64';
+    for (const os of [canonicalOs, legacyOs]) {
+        for (const arch of [canonicalArch, legacyArch]) {
+            const candidate = pattern
+                .replace(/\{os\}/g, os)
+                .replace(/\{arch\}/g, arch)
+                .replace(/\{ext\}/g, ext);
+            if (!seen.has(candidate)) {
+                seen.add(candidate);
+                variants.push(candidate);
+            }
+        }
+    }
+    return variants;
+}
+function canonical(...pairs) {
+    const p = platform();
+    for (const [match, value] of pairs) {
+        if (p === match)
+            return value;
+    }
+    return pairs[pairs.length - 1][1];
+}
+/**
+ * Download a URL to a file, optionally with a GitHub Bearer token. Uses
+ * Node's built-in fetch (Node 18+). Throws on non-2xx response or on
+ * network error.
+ */
+async function downloadFile(url, destPath, useGithubAuth) {
+    // Note: do NOT set Accept: application/octet-stream. GitHub's release
+    // download URL redirects to a CDN that returns 406 for that header. */* is
+    // safe and matches what curl/wget send by default.
+    const headers = {
+        Accept: '*/*',
+        'User-Agent': 'loom-cli',
+    };
+    if (useGithubAuth) {
+        try {
+            const token = execSync('gh auth token', { stdio: ['ignore', 'pipe', 'pipe'] }).toString().trim();
+            if (token)
+                headers.Authorization = `Bearer ${token}`;
+        }
+        catch {
+            // gh CLI not installed or not signed in -- proceed without auth.
+            // Public releases will still work; private will fail with 404.
+        }
+    }
+    const res = await fetch(url, { headers, redirect: 'follow' });
+    if (!res.ok) {
+        throw new Error(`HTTP ${res.status} ${res.statusText}`);
+    }
+    // Validate the response is an actual binary, not an HTML 404 / login wall.
+    // GitHub serves text/html with a 200 status code when the release tag or
+    // asset doesn't exist (e.g. the manifest pinned an outdated version).
+    // Caching that HTML as <name>.exe leaves the user with an 'invalid
+    // application' error at MCP launch time -- a slow, confusing failure.
+    // Fail loud here so the resolver can try the next candidate or surface
+    // a clear error.
+    const contentType = res.headers.get('content-type') ?? '';
+    if (/^text\/html\b/i.test(contentType)) {
+        throw new Error(`server returned text/html (likely 404 page disguised as 200) -- ` +
+            `release tag or asset name probably doesn't exist`);
+    }
+    const buf = Buffer.from(await res.arrayBuffer());
+    // Sanity-check binary magic for the platform we're targeting. Catches
+    // the CDN-served-HTML case even if the server forgot the content-type
+    // header. Skipped for non-exe extensions (e.g. raw binary names on Linux).
+    if (destPath.toLowerCase().endsWith('.exe')) {
+        if (buf.length < 2 || buf[0] !== 0x4d || buf[1] !== 0x5a) {
+            throw new Error(`downloaded file is not a valid Windows PE executable (no MZ header). ` +
+                `Likely an HTML error page from GitHub.`);
+        }
+    }
+    // Atomic write via .tmp + rename to avoid leaving a partial cache file
+    // if the process is killed mid-write.
+    const tmp = destPath + '.tmp';
+    await writeFile(tmp, buf);
+    const fs = await import('node:fs/promises');
+    await fs.rename(tmp, destPath);
+}
+//# sourceMappingURL=binary-cache.js.map

package/dist/util/binary-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-cache.js","sourceRoot":"","sources":["../../src/util/binary-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAoB7C,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAkB,EAClB,MAA6B,GAAG,EAAE,GAAE,CAAC;IAErC,mEAAmE;IACnE,0EAA0E;IAC1E,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEzD,oEAAoE;IACpE,sEAAsE;IACtE,8CAA8C;IAC9C,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,YAAY,MAAM,CAAC,IAAI,yBAAyB,QAAQ,6EAA6E,CAAC,CAAC;YAC3I,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/E,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzC,0DAA0D;IAC1D,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,YAAY,MAAM,CAAC,IAAI,eAAe,UAAU,EAAE,CAAC,CAAC;YACxD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,sCAAsC;IACtC,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,mDAAmD;IACnD,wEAAwE;IACxE,EAAE;IACF,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IACnF,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QACnC,GAAG,EAAsC,yBAAyB;QAClE,MAAM,CAAC,OAAO,EAA2B,mCAAmC;QAC5E,MAAM,EAAmC,+BAA+B;QACxE,QAAQ,EAAiC,cAAc;KACxD,CAAC,CAAC,CAAC;IAGJ,MAAM,aAAa,GAAmB,EAAE,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,+BAA+B;QAC/B,aAAa,CAAC,IAAI,CAAC;YACjB,GAAG,EAAE,sBAAsB,MAAM,CAAC,IAAI,sBAAsB,GAAG,IAAI,QAAQ,EAAE;YAC7E,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,uDAAuD;QACvD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACrD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,aAAa,CAAC,IAAI,CAAC;oBACjB,GAAG,EAAE,qCAAqC,MAAM,CAAC,IAAI,IAAI,GAAG,IAAI,QAAQ,IAAI,QAAQ,EAAE;oBACtF,IAAI,EAAE,KAAK;iBACZ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,gEAAgE;IAChE,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,aAAa,EAAE,CAAC;QACpC,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC;YACpE,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;gBAC3B,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,GAAG,CAAC,YAAY,MAAM,CAAC,IAAI,gBAAgB,QAAQ,OAAO,UAAU,EAAE,CAAC,CAAC;YACxE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,YAAY,MAAM,CAAC,IAAI,KAAK,GAAG,OAAQ,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,eAAe;QACjB,CAAC;IACH,CAAC;IAED,GAAG,CAAC,YAAY,MAAM,CAAC,IAAI,oCAAoC,aAAa,CAAC,MAAM,sCAAsC,GAAG,6BAA6B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnL,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,6CAA6C;IAC7C,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9F,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACnE,MAAM,GAAG,GAAG,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjD,uDAAuD;IACvD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAE9D,KAAK,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,OAAO;iBACtB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;iBACtB,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC;iBAC1B,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,GAAG,KAAyB;IAC7C,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,QAAgB,EAAE,aAAsB;IAC/E,sEAAsE;IACtE,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,KAAK;QACb,YAAY,EAAE,UAAU;KACzB,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;YACjG,IAAI,KAAK;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,+DAA+D;QACjE,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,uEAAuE;IACvE,iBAAiB;IACjB,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,kEAAkE;YAClE,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAEjD,sEAAsE;IACtE,sEAAsE;IACtE,2EAA2E;IAC3E,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,uEAAuE;gBACvE,wCAAwC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,sCAAsC;IACtC,MAAM,GAAG,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9B,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC"}

package/dist/util/frontmatter.d.ts

@@ -0,0 +1,53 @@
+/**
+ * YAML frontmatter parsing for `.agent.md` (and other) markdown files.
+ *
+ * Lives under `src/util/` because frontmatter handling is needed by every
+ * layer (chat, run, renderers, manifest). Putting it under `src/chat/`
+ * forced renderers + util code to import a chat module — wrong dependency
+ * direction. `src/chat/frontmatter.ts` re-exports these for backwards
+ * compatibility with older imports.
+ *
+ * Minimal, tolerant parser: extracts the top-most `---` fenced block,
+ * hands the body to js-yaml, and returns a normalized view of the fields
+ * `loom <agent>` cares about. Files without frontmatter are not an error —
+ * they simply yield an empty metadata object.
+ *
+ * Tolerant of:
+ *   - LF or CRLF line endings (Windows-authored agent files)
+ *   - UTF-8 BOM at the start of the file (also common on Windows)
+ *
+ * Three exports cover every shape we need:
+ *   - `parseAgentFrontmatter(path)` — read from disk, normalized view
+ *   - `parseFrontmatterRaw(content)` — string in, raw dict out
+ *   - `stripFrontmatter(content)` — body without the fenced block
+ *
+ * **Always use these instead of hand-rolling a `^---` regex** — the
+ * `repo-conventions.test.ts` lint enforces this.
+ */
+export interface AgentMetadata {
+    /** Human-readable agent name (frontmatter `name:` or the file's agent id) */
+    name?: string;
+    /** One-line description from `description:` */
+    description?: string;
+    /** Model hint, e.g. `claude-sonnet-4.5` (may be absent in CLI-shaped agents) */
+    model?: string;
+    /** Any other frontmatter fields, preserved for future use */
+    raw: Record<string, unknown>;
+}
+/**
+ * Parse the top-most `---` fenced YAML block from `content` and return it
+ * as a plain object. Returns `{}` when there's no frontmatter or the YAML
+ * is malformed. Tolerant of CRLF and a leading UTF-8 BOM.
+ */
+export declare function parseFrontmatterRaw(content: string): Record<string, unknown>;
+/**
+ * Return `content` with the leading `---` fenced YAML block removed.
+ * No-op when there is no frontmatter. Tolerant of CRLF and a leading BOM.
+ */
+export declare function stripFrontmatter(content: string): string;
+/**
+ * Parse the frontmatter from an agent file. Returns an empty metadata object
+ * (with `raw: {}`) when no frontmatter is present.
+ */
+export declare function parseAgentFrontmatter(agentFilePath: string): AgentMetadata;
+//# sourceMappingURL=frontmatter.d.ts.map

package/dist/util/frontmatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.d.ts","sourceRoot":"","sources":["../../src/util/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAaD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAW5E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,aAAa,CAe1E"}

package/dist/util/frontmatter.js

@@ -0,0 +1,85 @@
+/**
+ * YAML frontmatter parsing for `.agent.md` (and other) markdown files.
+ *
+ * Lives under `src/util/` because frontmatter handling is needed by every
+ * layer (chat, run, renderers, manifest). Putting it under `src/chat/`
+ * forced renderers + util code to import a chat module — wrong dependency
+ * direction. `src/chat/frontmatter.ts` re-exports these for backwards
+ * compatibility with older imports.
+ *
+ * Minimal, tolerant parser: extracts the top-most `---` fenced block,
+ * hands the body to js-yaml, and returns a normalized view of the fields
+ * `loom <agent>` cares about. Files without frontmatter are not an error —
+ * they simply yield an empty metadata object.
+ *
+ * Tolerant of:
+ *   - LF or CRLF line endings (Windows-authored agent files)
+ *   - UTF-8 BOM at the start of the file (also common on Windows)
+ *
+ * Three exports cover every shape we need:
+ *   - `parseAgentFrontmatter(path)` — read from disk, normalized view
+ *   - `parseFrontmatterRaw(content)` — string in, raw dict out
+ *   - `stripFrontmatter(content)` — body without the fenced block
+ *
+ * **Always use these instead of hand-rolling a `^---` regex** — the
+ * `repo-conventions.test.ts` lint enforces this.
+ */
+import { readFileSync } from 'node:fs';
+import yaml from 'js-yaml';
+const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
+/**
+ * Strip a leading UTF-8 BOM (U+FEFF) if present. Windows editors and
+ * PowerShell `>` redirection often add one, which would otherwise prevent
+ * `^---` from matching the frontmatter fence.
+ */
+function stripBom(content) {
+    return content.charCodeAt(0) === 0xfeff ? content.slice(1) : content;
+}
+/**
+ * Parse the top-most `---` fenced YAML block from `content` and return it
+ * as a plain object. Returns `{}` when there's no frontmatter or the YAML
+ * is malformed. Tolerant of CRLF and a leading UTF-8 BOM.
+ */
+export function parseFrontmatterRaw(content) {
+    const match = FRONTMATTER_RE.exec(stripBom(content));
+    if (!match)
+        return {};
+    let parsed;
+    try {
+        parsed = yaml.load(match[1]);
+    }
+    catch {
+        return {};
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return {};
+    return parsed;
+}
+/**
+ * Return `content` with the leading `---` fenced YAML block removed.
+ * No-op when there is no frontmatter. Tolerant of CRLF and a leading BOM.
+ */
+export function stripFrontmatter(content) {
+    return stripBom(content).replace(FRONTMATTER_RE, '').trim();
+}
+/**
+ * Parse the frontmatter from an agent file. Returns an empty metadata object
+ * (with `raw: {}`) when no frontmatter is present.
+ */
+export function parseAgentFrontmatter(agentFilePath) {
+    let content;
+    try {
+        content = readFileSync(agentFilePath, 'utf-8');
+    }
+    catch {
+        return { raw: {} };
+    }
+    const raw = parseFrontmatterRaw(content);
+    return {
+        name: typeof raw.name === 'string' ? raw.name : undefined,
+        description: typeof raw.description === 'string' ? raw.description : undefined,
+        model: typeof raw.model === 'string' ? raw.model : undefined,
+        raw,
+    };
+}
+//# sourceMappingURL=frontmatter.js.map

package/dist/util/frontmatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.js","sourceRoot":"","sources":["../../src/util/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,SAAS,CAAC;AAa3B,MAAM,cAAc,GAAG,mCAAmC,CAAC;AAE3D;;;;GAIG;AACH,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9E,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO;QACL,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACzD,WAAW,EAAE,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC9E,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC5D,GAAG;KACJ,CAAC;AACJ,CAAC"}

package/dist/util/loom-home.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Resolve the loom home directory.
+ *
+ * Default: `~/.loom`. Overridable via the `LOOM_HOME` env var. The
+ * env var must be an absolute path; relative paths are rejected to
+ * prevent surprising behavior when callers set it once and then
+ * change cwd.
+ *
+ * Why a single helper: this path is the root for staged dirs, repo
+ * cache, MCP binaries, sessions, run artifacts, repos.yaml, and the
+ * top-level config.yaml. Hardcoding `~/.loom` in each module makes
+ * test sandboxing painful and forecloses on a future dobby-CLI rebrand
+ * (where the same code might write to `~/.dobby/`).
+ *
+ * The function is LAZY -- never cached -- because tests need to be
+ * able to set HOME / USERPROFILE / LOOM_HOME on a per-test basis.
+ */
+export declare function loomHomeDir(): string;
+//# sourceMappingURL=loom-home.d.ts.map

package/dist/util/loom-home.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loom-home.d.ts","sourceRoot":"","sources":["../../src/util/loom-home.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,wBAAgB,WAAW,IAAI,MAAM,CAiBpC"}

package/dist/util/loom-home.js

@@ -0,0 +1,37 @@
+/**
+ * Resolve the loom home directory.
+ *
+ * Default: `~/.loom`. Overridable via the `LOOM_HOME` env var. The
+ * env var must be an absolute path; relative paths are rejected to
+ * prevent surprising behavior when callers set it once and then
+ * change cwd.
+ *
+ * Why a single helper: this path is the root for staged dirs, repo
+ * cache, MCP binaries, sessions, run artifacts, repos.yaml, and the
+ * top-level config.yaml. Hardcoding `~/.loom` in each module makes
+ * test sandboxing painful and forecloses on a future dobby-CLI rebrand
+ * (where the same code might write to `~/.dobby/`).
+ *
+ * The function is LAZY -- never cached -- because tests need to be
+ * able to set HOME / USERPROFILE / LOOM_HOME on a per-test basis.
+ */
+import { homedir } from 'node:os';
+import { join, isAbsolute } from 'node:path';
+let warnedAboutRelativeOverride = false;
+export function loomHomeDir() {
+    const override = process.env.LOOM_HOME;
+    if (override && override.length > 0) {
+        if (isAbsolute(override)) {
+            return override;
+        }
+        // Reject relative paths but don't crash the caller. The caller is
+        // typically a path getter and breaking it would surface as a
+        // confusing ENOENT downstream. Warn once, fall back to default.
+        if (!warnedAboutRelativeOverride) {
+            warnedAboutRelativeOverride = true;
+            process.stderr.write(`  warning: LOOM_HOME='${override}' is not absolute; falling back to default ~/.loom.\n`);
+        }
+    }
+    return join(homedir(), '.loom');
+}
+//# sourceMappingURL=loom-home.js.map

package/dist/util/loom-home.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loom-home.js","sourceRoot":"","sources":["../../src/util/loom-home.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE7C,IAAI,2BAA2B,GAAG,KAAK,CAAC;AAExC,MAAM,UAAU,WAAW;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;IACvC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,kEAAkE;QAClE,6DAA6D;QAC7D,gEAAgE;QAChE,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACjC,2BAA2B,GAAG,IAAI,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yBAAyB,QAAQ,uDAAuD,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC"}

package/dist/util/workspace-folder.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Shared helper: expand `${workspaceFolder:X}` placeholders in MCP
+ * args and cwd. Used by apply.ts after manifest resolution so the
+ * placeholder semantics are identical regardless of the source
+ * manifest layout (canonical contents:-wrapped or flat).
+ *
+ * The placeholder is resolved against a repo-name -> dir-name map
+ * built from the manifest's repos: block. Both repo.name and repo.id
+ * are entries in the map (pointing to the dir loom will place the
+ * clone at), so manifests can use either form.
+ */
+export declare function buildRepoNameMap<T extends {
+    id?: string;
+    name?: string;
+}>(repos: ReadonlyArray<T>, 
+/**
+ * Function that returns the directory name a repo will be placed at
+ * in the workspace. Concrete callers wire this to deriveRepoDir or
+ * an equivalent so the map matches what cloneManifestRepos / lazy-
+ * stage actually does.
+ */
+dirNameFor: (repo: T) => string): Map<string, string>;
+/**
+ * Replace every `${workspaceFolder:X}` in the input with
+ * `<workDir>/<resolved>` where resolved is the repoNameMap lookup
+ * (falling back to X verbatim).
+ */
+export declare function expandWorkspaceFolder(value: string, repoNameMap: Map<string, string>, workDir: string): string;
+//# sourceMappingURL=workspace-folder.d.ts.map

package/dist/util/workspace-folder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-folder.d.ts","sourceRoot":"","sources":["../../src/util/workspace-folder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACvE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;AACvB;;;;;GAKG;AACH,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,GAC9B,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CASrB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,OAAO,EAAE,MAAM,GACd,MAAM,CAKR"}

package/dist/util/workspace-folder.js

@@ -0,0 +1,43 @@
+/**
+ * Shared helper: expand `${workspaceFolder:X}` placeholders in MCP
+ * args and cwd. Used by apply.ts after manifest resolution so the
+ * placeholder semantics are identical regardless of the source
+ * manifest layout (canonical contents:-wrapped or flat).
+ *
+ * The placeholder is resolved against a repo-name -> dir-name map
+ * built from the manifest's repos: block. Both repo.name and repo.id
+ * are entries in the map (pointing to the dir loom will place the
+ * clone at), so manifests can use either form.
+ */
+import { join } from 'node:path';
+export function buildRepoNameMap(repos, 
+/**
+ * Function that returns the directory name a repo will be placed at
+ * in the workspace. Concrete callers wire this to deriveRepoDir or
+ * an equivalent so the map matches what cloneManifestRepos / lazy-
+ * stage actually does.
+ */
+dirNameFor) {
+    const map = new Map();
+    for (const r of repos) {
+        const dirName = dirNameFor(r);
+        if (r.name)
+            map.set(r.name, dirName);
+        if (r.id)
+            map.set(r.id, dirName);
+        map.set(dirName, dirName); // identity, in case the placeholder uses the dir name
+    }
+    return map;
+}
+/**
+ * Replace every `${workspaceFolder:X}` in the input with
+ * `<workDir>/<resolved>` where resolved is the repoNameMap lookup
+ * (falling back to X verbatim).
+ */
+export function expandWorkspaceFolder(value, repoNameMap, workDir) {
+    return value.replace(/\$\{workspaceFolder:([^}]+)\}/g, (_match, name) => {
+        const dirName = repoNameMap.get(name) ?? name;
+        return join(workDir, dirName);
+    });
+}
+//# sourceMappingURL=workspace-folder.js.map

package/dist/util/workspace-folder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-folder.js","sourceRoot":"","sources":["../../src/util/workspace-folder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,gBAAgB,CAC9B,KAAuB;AACvB;;;;;GAKG;AACH,UAA+B;IAE/B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACjC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,sDAAsD;IACnF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,WAAgC,EAChC,OAAe;IAEf,OAAO,KAAK,CAAC,OAAO,CAAC,gCAAgC,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAC9E,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QAC9C,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/validate.d.ts

@@ -1,5 +1,11 @@
 /**
- * Manifest validation — schema, reference, and registry checks.
+ * Manifest validation -- schema, reference, and registry checks.
+ *
+ * Per U6, this validator probes both `manifest.yaml` (canonical) and
+ * `dobby.yaml` (legacy alias) inside the template dir, and runs the
+ * raw YAML through `normalizeManifestAliases` so dobby-style field
+ * names (`mcpServers:`, `sparseCheckout:`, `team:`) and flat layout
+ * are validated against the same schema as canonical manifests.
  */
 export interface ValidateResult {
     templateId: string;

package/dist/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAYH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAC;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,cAAc,CAAC,CA+GzB;AAMD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,cAAc,EAAE,CAAC,CAyC3B"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAC;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,cAAc,CAAC,CAgKzB;AAMD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,cAAc,EAAE,CAAC,CA4D3B"}