@amsterdamdatalabs/enact-extensions 0.1.1 → 0.1.5

package/scripts/lib/run-uninstall.mjs

@@ -9,6 +9,7 @@ import {
   defaultSharedHome,
 } from "../../dist/index.js";
 import { appendEntry } from "./ledger.mjs";
+import { removePluginHooks } from "./hooks.mjs";
 
 // ---------------------------------------------------------------------------
 // resolveHomes — mirrors run-install.mjs; same scope/per-platform-home logic.
@@ -19,7 +20,7 @@ function resolveHomes(options) {
   return {
     scope,
     codexHome: options.codexHome ?? (scope === "local" ? local(".codex") : undefined),
-    enactHome: options.enactHome ?? (scope === "local" ? local(".enact") : defaultEnactHome()),
+    enactHome: options.enactHome ?? (scope === "local" ? local(".enact/agent") : defaultEnactHome()),
     claudeHome: options.claudeHome ?? (scope === "local" ? local(".claude") : undefined),
     cursorHome: options.cursorHome ?? (scope === "local" ? local(".cursor") : undefined),
     sharedHome: options.sharedHome ?? (scope === "local" ? process.cwd() : defaultSharedHome()),
@@ -29,7 +30,7 @@ function resolveHomes(options) {
 // ---------------------------------------------------------------------------
 // ALL_PLATFORMS / parsePlatforms — reuse same logic as run-install.mjs
 // ---------------------------------------------------------------------------
-const ALL_PLATFORMS = ["codex", "claude", "cursor", "enact", "shared"];
+const ALL_PLATFORMS = ["codex", "claude", "cursor", "enact"];
 
 /**
  * Expand "all" and split comma-separated platform lists.
@@ -83,11 +84,26 @@ function recordUninstall(name, version, platform, homes, options, result) {
       scope: homes.scope,
       home: homes[platformHomeField(platform)] ?? homes.enactHome,
       path,
+      marketplaceName: options.marketplaceName ?? "enact-os-plugins",
     },
     options,
   );
 }
 
+function removeInstalledPluginHooks(name, platform, homes, options) {
+  if (!["codex", "claude", "cursor", "enact"].includes(platform)) return;
+  const hookResult = removePluginHooks(platform, name, {
+    cwd: options.cwd ?? process.cwd(),
+    codexHome: platform === "codex" ? homes.codexHome : undefined,
+    claudeHome: platform === "claude" ? homes.claudeHome : undefined,
+    cursorHome: platform === "cursor" ? homes.cursorHome : undefined,
+    enactHome: platform === "enact" ? homes.enactHome : undefined,
+  });
+  if (hookResult.result !== "not_found" && hookResult.result !== "skipped") {
+    console.log(`hooks ${hookResult.result} for ${name} on ${platform} -> ${hookResult.location}`);
+  }
+}
+
 function platformHomeField(platform) {
   switch (platform) {
     case "enact": return "enactHome";
@@ -109,6 +125,11 @@ function platformHomeField(platform) {
 function runSinglePlatform(name, platform, homes, options) {
   let result;
 
+  // Remove plugin hook registrations before platform uninstall rewrites host
+  // config files. Some serializers preserve hook tables but drop marker
+  // comments, so post-uninstall cleanup would lose its reversible marker.
+  removeInstalledPluginHooks(name, platform, homes, options);
+
   switch (platform) {
     case "enact":
       result = uninstallCodexPluginBundle(name, {
@@ -143,6 +164,7 @@ function runSinglePlatform(name, platform, homes, options) {
   }
 
   if (result.noop) {
+    removeInstalledPluginHooks(name, platform, homes, options);
     process.stderr.write(
       `[enact-extensions uninstall] Nothing to remove for ${name} on ${platform} (not installed).\n`,
     );
@@ -154,6 +176,8 @@ function runSinglePlatform(name, platform, homes, options) {
   }
   console.log(`uninstalled ${name} from ${platform}`);
 
+  removeInstalledPluginHooks(name, platform, homes, options);
+
   // Record uninstall in ledger (best-effort)
   recordUninstall(name, options.version, platform, homes, options, result);
 

package/scripts/lib/run-validate.mjs

@@ -1,6 +1,7 @@
 import {
   validatePluginBundleFromCanonical,
   checkPluginBundleComponentPathsFromCanonical,
+  checkHookEvents,
 } from "../../dist/index.js";
 
 /**
@@ -13,6 +14,7 @@ import {
 export function runValidate(pluginRoot, platforms) {
   const report = validatePluginBundleFromCanonical(pluginRoot, platforms);
   const warnings = checkPluginBundleComponentPathsFromCanonical(pluginRoot);
+  const hookErrors = checkHookEvents(pluginRoot);
 
   for (const result of report.results) {
     const status = result.ok ? "ok" : "FAIL";
@@ -22,9 +24,16 @@ export function runValidate(pluginRoot, platforms) {
     }
   }
 
+  if (hookErrors.length > 0) {
+    console.log(`[FAIL] hooks (${pluginRoot})`);
+    for (const err of hookErrors) {
+      console.log(`  - ${err}`);
+    }
+  }
+
   for (const warn of warnings) {
     console.log(`[warn] ${warn}`);
   }
 
-  return report.ok && warnings.length === 0;
+  return report.ok && warnings.length === 0 && hookErrors.length === 0;
 }

package/scripts/lib/serve.mjs

@@ -436,9 +436,27 @@ export function createServer(opts = {}) {
  * @param {object} [opts.installDefaults] - Merged into runInstall/runUninstall calls.
  * @returns {Promise<{ server: http.Server, url: string }>}
  */
+// ENACT OS port-registry convention: dev listeners live in 43xxx, prod in 53xxx.
+export const DEV_PORT = 43217;
+export const PROD_PORT = 53217;
+
+/**
+ * Resolve the serve port: an explicit `--port` always wins; otherwise `--prod`
+ * selects the prod-series port (53217) and the default is the dev-series port
+ * (43217). Pure (no I/O) so it is unit-testable without binding a socket.
+ * @param {object} [opts]
+ * @param {number} [opts.port] - Explicit port (wins; 0 = ephemeral).
+ * @param {boolean} [opts.prod] - Use the prod-series port (53217).
+ * @returns {number}
+ */
+export function resolveServePort(opts = {}) {
+  if (opts.port !== undefined && opts.port !== null) return opts.port;
+  return opts.prod ? PROD_PORT : DEV_PORT;
+}
+
 export function startServer(opts = {}) {
   const host = opts.host ?? "127.0.0.1";
-  const port = opts.port ?? 43217;
+  const port = resolveServePort(opts);
 
   const server = createServer(opts);
 

package/scripts/version-bump.sh

@@ -0,0 +1,463 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+#  version-bump.sh
+#  Auto-bumps patch version (x.y.z → x.y.z+1) on a feat/* or fix/* branch,
+#  as the LAST CI step before the PR merges into integration.
+#
+#  Strategy (runs on the feature branch, not on integration):
+#    1. Must be on a feat/* or fix/* branch — not on integration itself.
+#    2. Fetches origin/integration and compares versions:
+#         Same    → PR did not manually bump → auto-bump on the feature branch.
+#         Different → developer bumped intentionally in the PR → skip silently.
+#    3. Commits + pushes the bump back to the SAME feature branch (***NO_CI***
+#       prevents a second pipeline run). The PR then merges to integration
+#       already carrying the bumped version.
+#
+#  Why not push to integration directly?
+#    Azure DevOps branch policy (TF402455) blocks direct pushes to protected
+#    branches. We never bypass this — instead we bump on the feature branch.
+#
+#  Supported manifest types — detected from filename, no scanning:
+#    package.json    → npm    (.version)
+#    pyproject.toml  → python ([project] version, uv / PEP 621)
+#    Cargo.toml      → rust   ([package] version)
+#
+#  Usage:
+#    ./scripts/version-bump.sh --file <path/to/manifest> [OPTIONS]
+#
+#  Options:
+#    -f, --file   <path>   REQUIRED. Exact path to the version manifest.
+#    -b, --branch <name>   Integration branch to compare against (default: integration)
+#        --push            Push the bump commit back to the feature branch
+#    -n, --dry-run         Print what would change; no edits, no commit
+#    -h, --help            Show this help
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+
+# ── ANSI colours ──────────────────────────────────────────────────────────────
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'
+BLUE='\033[0;34m'; BOLD='\033[1m'; NC='\033[0m'
+info()  { printf "${BLUE}[INFO]${NC}  %s\n"  "$*"; }
+ok()    { printf "${GREEN}[OK]${NC}    %s\n"  "$*"; }
+warn()  { printf "${YELLOW}[WARN]${NC}  %s\n" "$*"; }
+die()   { printf "${RED}[ERROR]${NC} %s\n" "$*" >&2; exit 1; }
+step()  { printf "\n${BOLD}▶ %s${NC}\n" "$*"; }
+
+# ── State ─────────────────────────────────────────────────────────────────────
+VERSION_FILE=""
+PROJECT_TYPE=""
+GIT_REPO_ROOT=""
+CURRENT_VERSION=""
+CURRENT_BRANCH=""
+INTEGRATION_BRANCH="integration"
+DRY_RUN=false
+DO_PUSH=false
+
+# ─────────────────────────────────────────────────────────────────────────────
+usage() {
+  cat <<'HELP'
+version-bump.sh — Bump patch version (x.y.z → x.y.z+1) on a feat/fix branch before merge
+
+USAGE
+  ./scripts/version-bump.sh --file <path> [OPTIONS]
+
+OPTIONS
+  -f, --file   <path>   REQUIRED. Exact path to the version manifest:
+                          package.json   → npm
+                          pyproject.toml → python (PEP 621 / uv)
+                          Cargo.toml     → rust
+  -b, --branch <name>   Integration branch to compare against (default: integration)
+      --push            Push the bump commit back to the feature branch after committing
+  -n, --dry-run         Show what would change; do not modify or commit
+  -h, --help            Show this message
+
+GUARDS
+  1. Must be on a feat/* or fix/* branch — never runs on integration directly.
+  2. Fetches origin/<integration-branch> and compares versions:
+       Same    → PR did not manually bump the version → auto-bump.
+       Different → developer bumped intentionally in the PR → skip silently.
+
+PUSH TARGET
+  The bump commit is pushed back to the CURRENT feature branch (not integration).
+  Azure DevOps branch policies block direct pushes to integration; we never bypass them.
+
+CI SKIP
+  Bump commit message contains ***NO_CI*** — Azure DevOps' official keyword
+  to prevent the resulting push from re-triggering the pipeline.
+
+AZURE PIPELINES — add as last step in the CI job, covering PR builds on feat/* / fix/*:
+
+  - script: |
+      git config user.email "pipeline@build.com"
+      git config user.name  "Azure Pipelines"
+      git remote set-url origin \
+        "https://x-token:$(System.AccessToken)@dev.azure.com/org/project/_git/repo"
+      bash scripts/version-bump.sh --file package.json --push
+    displayName: Bump patch version
+    condition: |
+      and(
+        succeeded(),
+        or(
+          startsWith(variables['System.PullRequest.SourceBranch'], 'refs/heads/feat/'),
+          startsWith(variables['System.PullRequest.SourceBranch'], 'refs/heads/fix/'),
+          startsWith(variables['Build.SourceBranch'], 'refs/heads/feat/'),
+          startsWith(variables['Build.SourceBranch'], 'refs/heads/fix/')
+        ),
+        not(contains(variables['Build.SourceVersionMessage'], '***NO_CI***'))
+      )
+    env:
+      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+      BUILD_SOURCEBRANCH: $(Build.SourceBranch)
+      SYSTEM_PULLREQUEST_SOURCEBRANCH: $(System.PullRequest.SourceBranch)
+HELP
+  exit 0
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+parse_args() {
+  local file_given=false
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      -f|--file)   VERSION_FILE="${2:?'--file requires a path'}"; file_given=true; shift 2 ;;
+      -b|--branch) INTEGRATION_BRANCH="${2:?'--branch requires a name'}"; shift 2 ;;
+      --push)      DO_PUSH=true; shift ;;
+      -n|--dry-run) DRY_RUN=true; shift ;;
+      -h|--help)   usage ;;
+      *) die "Unknown option: '$1'. Run with --help." ;;
+    esac
+  done
+  $file_given || die "--file <path> is required. Example: --file package.json"
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+#  Resolve manifest + detect type from filename (no scanning)
+# ─────────────────────────────────────────────────────────────────────────────
+resolve_manifest() {
+  step "Resolving manifest"
+  [[ -f "$VERSION_FILE" ]] || die "Manifest not found: '${VERSION_FILE}'"
+
+  # Physical absolute path (handles /tmp → /private/tmp on macOS etc.)
+  VERSION_FILE="$(cd "$(dirname "$VERSION_FILE")" && pwd -P)/$(basename "$VERSION_FILE")"
+
+  local base
+  base="$(basename "$VERSION_FILE")"
+  case "$base" in
+    package.json)   PROJECT_TYPE="npm"    ;;
+    pyproject.toml) PROJECT_TYPE="python" ;;
+    Cargo.toml)     PROJECT_TYPE="rust"   ;;
+    *) die "Unrecognised manifest '${base}'. Expected: package.json | pyproject.toml | Cargo.toml" ;;
+  esac
+
+  local file_dir
+  file_dir="$(dirname "$VERSION_FILE")"
+  GIT_REPO_ROOT="$(git -C "$file_dir" rev-parse --show-toplevel 2>/dev/null)" || \
+    die "'${VERSION_FILE}' is not inside a git repository."
+  GIT_REPO_ROOT="$(cd "$GIT_REPO_ROOT" && pwd -P)"
+
+  info "Manifest      : ${VERSION_FILE}"
+  info "Type          : ${BOLD}${PROJECT_TYPE}${NC}"
+  info "Git repo root : ${GIT_REPO_ROOT}"
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+#  Version readers
+# ─────────────────────────────────────────────────────────────────────────────
+_read_npm() {
+  node -e "const fs=require('fs'); process.stdout.write(JSON.parse(fs.readFileSync('$1','utf8')).version)"
+}
+
+_read_python() {
+  python3 - "$1" <<'PY'
+import sys, re
+text = open(sys.argv[1]).read()
+def find_in_section(pat, text):
+    in_sect = False
+    for line in text.splitlines():
+        s = line.strip()
+        if re.match(pat, s):    in_sect = True;  continue
+        if re.match(r'^\[', s): in_sect = False
+        if in_sect:
+            m = re.match(r'^version\s*=\s*["\']([^"\']+)["\']', s)
+            if m: return m.group(1)
+    return None
+ver = (find_in_section(r'^\[project\]', text)
+    or find_in_section(r'^\[tool\.poetry\]', text))
+if not ver:
+    m = re.search(r'^version\s*=\s*["\']([^"\']+)["\']', text, re.M)
+    ver = m.group(1) if m else None
+if ver: sys.stdout.write(ver); sys.exit(0)
+sys.stderr.write(f"version not found in {sys.argv[1]}\n"); sys.exit(1)
+PY
+}
+
+_read_rust() {
+  python3 - "$1" <<'PY'
+import sys, re
+in_pkg = False
+for line in open(sys.argv[1]):
+    s = line.strip()
+    if re.match(r'^\[package\]', s): in_pkg = True;  continue
+    if re.match(r'^\[', s):          in_pkg = False
+    if in_pkg:
+        m = re.match(r'^version\s*=\s*["\']([^"\']+)["\']', s)
+        if m: sys.stdout.write(m.group(1)); sys.exit(0)
+sys.stderr.write(f"[package] version not found in {sys.argv[1]}\n"); sys.exit(1)
+PY
+}
+
+get_version() {
+  local file="${1:-$VERSION_FILE}"
+  case "$PROJECT_TYPE" in
+    npm)    _read_npm    "$file" ;;
+    python) _read_python "$file" ;;
+    rust)   _read_rust   "$file" ;;
+  esac
+}
+
+get_version_at_ref() {
+  local git_ref="$1"
+  local rel_file="${VERSION_FILE#"${GIT_REPO_ROOT}/"}"
+  local tmp
+  tmp="$(mktemp)"
+  trap "rm -f '${tmp}'" RETURN
+  git -C "$GIT_REPO_ROOT" show "${git_ref}:${rel_file}" > "$tmp" 2>/dev/null || \
+    die "Cannot read '${rel_file}' at ref '${git_ref}'. Is the file committed?"
+  get_version "$tmp"
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+#  Patch bumper  x.y.z → x.y.(z+1)
+# ─────────────────────────────────────────────────────────────────────────────
+bump_patch() {
+  local core="${1%%[-+]*}"
+  local major minor patch
+  IFS='.' read -r major minor patch <<< "$core"
+  [[ "$major" =~ ^[0-9]+$ && "$minor" =~ ^[0-9]+$ && "$patch" =~ ^[0-9]+$ ]] || \
+    die "Cannot parse '${1}' as semver x.y.z"
+  echo "${major}.${minor}.$((patch + 1))"
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+#  Version writers
+# ─────────────────────────────────────────────────────────────────────────────
+_write_npm() {
+  python3 - "$1" "$2" <<'PY'
+import json, sys
+path, ver = sys.argv[1], sys.argv[2]
+d = json.load(open(path))
+d['version'] = ver
+with open(path, 'w') as f:
+    json.dump(d, f, indent=2, ensure_ascii=False); f.write('\n')
+PY
+}
+
+_write_python() {
+  python3 - "$1" "$2" <<'PY'
+import sys, re
+path, new_ver = sys.argv[1], sys.argv[2]
+lines = open(path).readlines()
+SECTIONS = [r'^\[project\]', r'^\[tool\.poetry\]']
+in_target = replaced = False
+result = []
+for line in lines:
+    s = line.strip()
+    if any(re.match(p, s) for p in SECTIONS): in_target = True
+    elif re.match(r'^\[', s):                  in_target = False
+    if in_target and not replaced:
+        new_line = re.sub(r'^(version\s*=\s*)["\']([^"\']+)["\']',
+                          lambda m: m.group(1) + '"' + new_ver + '"', line)
+        if new_line != line: replaced = True; line = new_line
+    result.append(line)
+if not replaced:
+    full = re.sub(r'^(version\s*=\s*)["\']([^"\']+)["\']',
+                  lambda m: m.group(1) + '"' + new_ver + '"',
+                  ''.join(result), count=1, flags=re.M)
+    open(path, 'w').write(full)
+else:
+    open(path, 'w').writelines(result)
+PY
+}
+
+_write_rust() {
+  python3 - "$1" "$2" <<'PY'
+import sys, re
+path, new_ver = sys.argv[1], sys.argv[2]
+lines = open(path).readlines()
+in_pkg = replaced = False
+result = []
+for line in lines:
+    s = line.strip()
+    if re.match(r'^\[package\]', s): in_pkg = True
+    elif re.match(r'^\[', s):        in_pkg = False
+    if in_pkg and not replaced:
+        new_line = re.sub(r'^(version\s*=\s*)["\']([^"\']+)["\']',
+                          lambda m: m.group(1) + '"' + new_ver + '"', line)
+        if new_line != line: replaced = True; line = new_line
+    result.append(line)
+open(path, 'w').writelines(result)
+PY
+}
+
+set_version() {
+  case "$PROJECT_TYPE" in
+    npm)    _write_npm    "$VERSION_FILE" "$1" ;;
+    python) _write_python "$VERSION_FILE" "$1" ;;
+    rust)   _write_rust   "$VERSION_FILE" "$1" ;;
+  esac
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+#  Lock file updates (best-effort, non-fatal)
+# ─────────────────────────────────────────────────────────────────────────────
+update_lock_files() {
+  case "$PROJECT_TYPE" in
+    rust)
+      if command -v cargo &>/dev/null; then
+        info "Regenerating Cargo.lock (cargo update --workspace)…"
+        cargo update --workspace --quiet 2>/dev/null || warn "cargo update failed — Cargo.lock may be stale."
+      else
+        warn "cargo not found — Cargo.lock NOT updated."
+      fi ;;
+    python)
+      if command -v uv &>/dev/null; then
+        info "Regenerating uv.lock (uv lock)…"
+        uv lock --quiet 2>/dev/null || warn "uv lock failed — uv.lock may be stale."
+      fi ;;
+    npm)
+      warn "npm lock file NOT touched — run 'npm install' locally to regenerate." ;;
+  esac
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+#  Guards
+# ─────────────────────────────────────────────────────────────────────────────
+validate_branch() {
+  step "Validating source branch"
+  local branch
+  branch="$(git -C "$GIT_REPO_ROOT" rev-parse --abbrev-ref HEAD)"
+
+  # Azure Pipelines checks out in detached HEAD state.
+  # In PR builds, SYSTEM_PULLREQUEST_SOURCEBRANCH gives the real source branch.
+  # In IndividualCI builds, BUILD_SOURCEBRANCH gives the branch.
+  if [[ "$branch" == "HEAD" ]]; then
+    local pr_branch="${SYSTEM_PULLREQUEST_SOURCEBRANCH:-}"
+    local ci_branch="${BUILD_SOURCEBRANCH:-${GITHUB_REF:-}}"
+    # Azure DevOps passes '$(Var.Name)' literally when the variable is undefined.
+    # Discard any value that looks like an unexpanded template.
+    [[ "$pr_branch" == '$('* ]] && pr_branch=""
+    [[ "$ci_branch"  == '$('* ]] && ci_branch=""
+    # PR build: prefer the PR source branch (not the synthetic merge ref)
+    local env_branch="${pr_branch:-$ci_branch}"
+    branch="${env_branch#refs/heads/}"
+    [[ -n "$branch" ]] || \
+      die "Detached HEAD and no branch env var set. Cannot determine branch."
+    info "Detached HEAD — branch from env: ${branch}"
+  fi
+
+  [[ "$branch" =~ ^(feat|fix)/ ]] || \
+    die "Expected a feat/* or fix/* branch, currently on '${branch}'. Version bump runs on feature branches before PR merge."
+
+  ok "On feature branch '${branch}'."
+  CURRENT_BRANCH="$branch"
+}
+
+# Guard: compare current branch version against origin/integration.
+# Same    → PR did not manually bump → auto-bump this branch.
+# Different → manual bump in PR → skip silently (exit 0).
+validate_version_unchanged() {
+  step "Comparing version against origin/${INTEGRATION_BRANCH}"
+
+  local rel_file="${VERSION_FILE#"${GIT_REPO_ROOT}/"}"
+  local v_now v_integration
+
+  v_now="$(get_version)" || die "Cannot read current version from manifest."
+
+  # Fetch latest integration so our remote tracking ref is up to date.
+  git -C "$GIT_REPO_ROOT" fetch origin "${INTEGRATION_BRANCH}" --quiet 2>/dev/null || \
+    warn "Could not fetch origin/${INTEGRATION_BRANCH} — using cached remote tracking branch."
+
+  # If the manifest doesn't exist on integration yet (new project), just bump.
+  if ! git -C "$GIT_REPO_ROOT" show "origin/${INTEGRATION_BRANCH}:${rel_file}" >/dev/null 2>&1; then
+    warn "Manifest '${rel_file}' not found on '${INTEGRATION_BRANCH}' — treating as new project; bumping."
+    CURRENT_VERSION="$v_now"
+    return
+  fi
+
+  local tmp
+  tmp="$(mktemp)"
+  trap "rm -f '${tmp}'" RETURN
+  git -C "$GIT_REPO_ROOT" show "origin/${INTEGRATION_BRANCH}:${rel_file}" > "$tmp" 2>/dev/null
+  v_integration="$(get_version "$tmp")" || die "Cannot read version from origin/${INTEGRATION_BRANCH}."
+
+  info "Version on this branch       : ${v_now}"
+  info "Version on ${INTEGRATION_BRANCH}            : ${v_integration}"
+
+  if [[ "$v_now" != "$v_integration" ]]; then
+    printf "\n${YELLOW}${BOLD}↳ Version differs (%s here vs %s on %s). Manual bump detected — skipping auto-bump.${NC}\n\n" \
+      "$v_now" "$v_integration" "$INTEGRATION_BRANCH"
+    exit 0   # clean exit — not an error
+  fi
+
+  ok "Versions match at ${BOLD}${v_now}${NC} — safe to auto-bump."
+  CURRENT_VERSION="$v_now"
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+#  Commit  — ***NO_CI*** suppresses Azure DevOps CI on the resulting push
+# ─────────────────────────────────────────────────────────────────────────────
+commit_bump() {
+  local new_ver="$1"
+  git -C "$GIT_REPO_ROOT" add "$VERSION_FILE"
+  case "$PROJECT_TYPE" in
+    rust)   [[ -f "${GIT_REPO_ROOT}/Cargo.lock" ]] && git -C "$GIT_REPO_ROOT" add "${GIT_REPO_ROOT}/Cargo.lock" || true ;;
+    python) [[ -f "${GIT_REPO_ROOT}/uv.lock"    ]] && git -C "$GIT_REPO_ROOT" add "${GIT_REPO_ROOT}/uv.lock"    || true ;;
+  esac
+  git -C "$GIT_REPO_ROOT" commit -m "chore: bump version ${CURRENT_VERSION} → ${new_ver} ***NO_CI***"
+  ok "Committed: chore: bump version ${CURRENT_VERSION} → ${new_ver} ***NO_CI***"
+}
+
+push_bump() {
+  local remote
+  remote="$(git -C "$GIT_REPO_ROOT" remote | head -1)"
+  [[ -n "$remote" ]] || die "No git remote found — cannot push."
+  info "Pushing to ${remote}/${CURRENT_BRANCH}…"
+  git -C "$GIT_REPO_ROOT" push "$remote" "HEAD:${CURRENT_BRANCH}"
+  ok "Pushed to ${remote}/${CURRENT_BRANCH}."
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+#  Main
+# ─────────────────────────────────────────────────────────────────────────────
+main() {
+  parse_args "$@"
+  resolve_manifest
+  validate_branch
+  validate_version_unchanged   # exits 0 silently if version was manually bumped
+
+  local new_version
+  new_version="$(bump_patch "$CURRENT_VERSION")"
+
+  step "Version bump"
+  info "  ${CURRENT_VERSION}  →  ${BOLD}${new_version}${NC}"
+
+  if $DRY_RUN; then
+    warn "Dry-run — no files modified, no commit made."
+    return 0
+  fi
+
+  set_version "$new_version"
+  ok "Updated ${VERSION_FILE}"
+  update_lock_files "$new_version"
+
+  step "Committing"
+  commit_bump "$new_version"
+
+  if $DO_PUSH; then
+    step "Pushing"
+    push_bump
+  fi
+
+  printf "\n${GREEN}${BOLD}✓ Done.${NC} Version bumped to ${BOLD}%s${NC}\n\n" "$new_version"
+}
+
+main "$@"

package/spec/codex.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "codex-plugin.json",
   "title": "Codex Plugin Manifest",
-  "description": "Validates .codex-plugin/plugin.json for OpenAI Codex plugins. Matches the enact-operator plugin structure.",
+  "description": "Validates .codex-plugin/plugin.json for OpenAI Codex plugins. Based on the OpenAI Codex plugin build docs.",
   "type": "object",
   "required": [
     "name"
@@ -69,11 +69,6 @@
       "description": "Relative path to the skills directory.",
       "default": "./skills/"
     },
-    "commands": {
-      "type": "string",
-      "description": "Relative path to slash commands directory (flat Markdown files).",
-      "default": "./commands/"
-    },
     "mcpServers": {
       "type": "string",
       "description": "Relative path to the .mcp.json MCP server configuration file.",
@@ -144,11 +139,6 @@
           "description": "Human-readable list of capabilities shown in the plugin directory."
         }
       }
-    },
-    "agents": {
-      "type": "string",
-      "description": "Relative path to the agents dir.",
-      "default": "./agents/"
     }
   }
 }