@amsterdamdatalabs/enact-extensions 0.1.37 → 0.1.47

package/scripts/check-hooks.mjs

@@ -1,174 +0,0 @@
-#!/usr/bin/env node
-/**
- * Repo guard: validate every plugin's hooks before they ship.
- *
- * Born from real breakage: a bundle shipped hook entries for a deleted
- * CLI (module-not-found at runtime), and an npm package omitted `extensions/`
- * from its files whitelist so its hook command could never load. Both passed
- * every static check yet failed the moment Claude Code fired the hook.
- * plugin-dev meanwhile
- * declared a `hooks` component whose hooks.json was `{ "hooks": {} }` — a
- * component that installs nothing.
- *
- * Two passes:
- *   STATIC (always, no binaries): every plugin that declares a `hooks` manifest
- *     field must have a hooks file that is valid JSON, has a NON-EMPTY `hooks`
- *     object, and whose every entry is a well-formed `command` hook.
- *   SMOKE (--smoke, best-effort): for each distinct hook command whose binary
- *     resolves on PATH, actually run it with a synthetic payload in an isolated
- *     HOME/TMPDIR and fail if it crashes on module resolution (the exact class
- *     of bug above). Binaries that aren't installed are skipped, so this stays
- *     green in CI where the plugin CLIs are absent.
- *
- * Run via `npm run check:hooks` (static) or `npm run check:hooks:smoke`.
- */
-import { readFileSync, existsSync, readdirSync, statSync, mkdtempSync, rmSync } from "node:fs";
-import { join, dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { tmpdir } from "node:os";
-import { spawnSync, execSync } from "node:child_process";
-
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
-const EXT = join(ROOT, "extensions");
-const SMOKE = process.argv.includes("--smoke");
-
-const errors = [];
-const warnings = [];
-const notes = [];
-const err = (p, m) => errors.push(`[ERROR] ${p}: ${m}`);
-const warn = (p, m) => warnings.push(`[warn]  ${p}: ${m}`);
-const note = (m) => notes.push(`[note]  ${m}`);
-
-function isDir(p) {
-  try { return statSync(p).isDirectory(); } catch { return false; }
-}
-
-// Module-resolution / load crash signatures — the failure class this guard exists for.
-const CRASH = [
-  "Cannot find module",
-  "Cannot find package",
-  "ERR_MODULE_NOT_FOUND",
-  "MODULE_NOT_FOUND",
-  "ERR_REQUIRE_ESM",
-  "ERR_PACKAGE_PATH_NOT_EXPORTED",
-];
-
-function onPath(bin) {
-  try { execSync(`command -v ${bin}`, { stdio: "ignore", shell: "/bin/sh" }); return true; }
-  catch { return false; }
-}
-
-// Walk a hooks.json object, yielding { event, command } for every command entry.
-function* commandEntries(hooks, id) {
-  for (const [event, groups] of Object.entries(hooks)) {
-    if (!Array.isArray(groups)) { err(id, `hooks.${event} is not an array`); continue; }
-    for (const g of groups) {
-      const list = g && g.hooks;
-      if (!Array.isArray(list)) { err(id, `hooks.${event} group has no hooks[] array`); continue; }
-      for (const h of list) {
-        if (!h || h.type !== "command") { err(id, `hooks.${event} entry is not a command hook (type="${h && h.type}")`); continue; }
-        if (typeof h.command !== "string" || !h.command.trim()) { err(id, `hooks.${event} command hook has empty command`); continue; }
-        yield { event, command: h.command.trim() };
-      }
-    }
-  }
-}
-
-const smokePayload = JSON.stringify({
-  session_id: "hooks-smoke",
-  transcript_path: "/dev/null",
-  cwd: ROOT,
-  hook_event_name: "Smoke",
-  tool_name: "Bash",
-  tool_input: { command: "true" },
-  tool_response: {},
-});
-
-function smokeRun(command) {
-  const parts = command.split(/\s+/);
-  const bin = parts[0];
-  const args = parts.slice(1);
-  const home = mkdtempSync(join(tmpdir(), "hooks-smoke-"));
-  try {
-    const r = spawnSync(bin, args, {
-      input: smokePayload,
-      timeout: 8000,
-      encoding: "utf8",
-      env: { ...process.env, HOME: home, TMPDIR: home, XDG_CONFIG_HOME: join(home, ".config"), XDG_STATE_HOME: join(home, ".state") },
-    });
-    const out = `${r.stdout || ""}\n${r.stderr || ""}`;
-    if (r.error && r.error.code === "ETIMEDOUT") return { ok: true, soft: "timed out (hook may wait on stdin/state) — not a crash" };
-    if (r.error) return { ok: false, why: r.error.message };
-    const hit = CRASH.find((s) => out.includes(s));
-    if (hit) return { ok: false, why: `module-load crash: "${hit}"` };
-    if (r.signal) return { ok: false, why: `killed by signal ${r.signal}` };
-    return { ok: true };
-  } finally {
-    rmSync(home, { recursive: true, force: true });
-  }
-}
-
-if (!existsSync(EXT)) {
-  console.error(`No extensions dir at ${EXT}`);
-  process.exit(1);
-}
-
-const smokeCommands = new Set();
-
-for (const name of readdirSync(EXT)) {
-  const root = join(EXT, name);
-  if (!isDir(root)) continue;
-  const manifestPath = join(root, ".agents", "plugin.json");
-  if (!existsSync(manifestPath)) continue;
-  const id = `extensions/${name}`;
-  let m;
-  try { m = JSON.parse(readFileSync(manifestPath, "utf8")); }
-  catch (e) { err(id, `unreadable .agents/plugin.json: ${e.message}`); continue; }
-
-  const field = m.hooks;
-  if (!field) continue; // no hooks declared — nothing to validate here (E2 in check-principles covers undeclared dirs)
-
-  const hooksPath = resolve(root, field);
-  if (!existsSync(hooksPath)) { err(id, `manifest hooks -> "${field}" but file is missing at ${hooksPath}`); continue; }
-
-  let doc;
-  try { doc = JSON.parse(readFileSync(hooksPath, "utf8")); }
-  catch (e) { err(id, `${field} is not valid JSON: ${e.message}`); continue; }
-
-  const hooks = doc && doc.hooks;
-  if (!hooks || typeof hooks !== "object") { err(id, `${field} has no "hooks" object`); continue; }
-  if (Object.keys(hooks).length === 0) {
-    err(id, `${field} declares an empty hooks object — a hooks component that registers nothing; drop the "hooks" manifest field and the file`);
-    continue;
-  }
-
-  for (const { command } of commandEntries(hooks, id)) {
-    smokeCommands.add(command);
-  }
-}
-
-if (SMOKE) {
-  const cmds = [...smokeCommands].sort();
-  const bins = new Set(cmds.map((c) => c.split(/\s+/)[0]));
-  const present = new Set([...bins].filter(onPath));
-  for (const b of bins) if (!present.has(b)) note(`smoke skipped for "${b}" — not on PATH (can't test what isn't installed)`);
-  for (const c of cmds) {
-    const bin = c.split(/\s+/)[0];
-    if (!present.has(bin)) continue;
-    const r = smokeRun(c);
-    if (r.ok && r.soft) warn(`smoke`, `\`${c}\` ${r.soft}`);
-    else if (!r.ok) err(`smoke`, `\`${c}\` ${r.why}`);
-  }
-} else {
-  note(`static only — run with --smoke to exercise installed hook binaries (${smokeCommands.size} distinct commands)`);
-}
-
-for (const n of notes) console.log(n);
-for (const w of warnings) console.log(w);
-for (const e of errors) console.log(e);
-console.log(
-  errors.length
-    ? `\n✗ hooks check FAILED: ${errors.length} error(s), ${warnings.length} warning(s)`
-    : `\n✓ hooks check passed (${warnings.length} warning(s))`,
-);
-process.exit(errors.length ? 1 : 0);

package/scripts/check-principles.mjs

@@ -1,116 +0,0 @@
-#!/usr/bin/env node
-/**
- * Repo guard: enforce the authoring principles in docs/AUTHORING-GUIDELINES.md.
- * Fails (exit 1) on any ERROR. Pure Node, no deps. Run via `npm run
- * check:principles`; also wired into `test` and `prepublishOnly`, and the
- * optional `.githooks/pre-commit`.
- *
- * Rules:
- *  E1  No commands. A `commands/` dir or a `commands` manifest field is banned —
- *      commands are skills.
- *  E2  Declare every component. A `skills/`, `agents/`, or `hooks/` dir on disk
- *      must be named by the matching manifest field (else it silently doesn't
- *      install).
- *  E3  Skill hygiene. Each `skills/<dir>/` needs a `SKILL.md` with `name` +
- *      `description` frontmatter, and no `README.md`.
- *  E4  Surface targets are normalized repo-wide:
- *      - every bundled plugin targets claude/codex/cursor/enact
- */
-import { readFileSync, existsSync, readdirSync, statSync } from "node:fs";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
-const EXT = join(ROOT, "extensions");
-
-const errors = [];
-const warnings = [];
-const err = (p, m) => errors.push(`[ERROR] ${p}: ${m}`);
-const warn = (p, m) => warnings.push(`[warn]  ${p}: ${m}`);
-const ALL_SURFACE_TARGETS = ["claude", "codex", "cursor", "enact"];
-
-function frontmatter(file) {
-  const t = readFileSync(file, "utf8");
-  if (!t.startsWith("---")) return null;
-  const m = /^---\n([\s\S]*?)\n---/.exec(t);
-  if (!m) return null;
-  const body = m[1];
-  return {
-    name: /(^|\n)name:/.test(body),
-    description: /(^|\n)description:/.test(body),
-  };
-}
-
-function isDir(p) {
-  try { return statSync(p).isDirectory(); } catch { return false; }
-}
-
-function normalizedTargets(value) {
-  if (!Array.isArray(value)) return null;
-  return value.filter((entry) => typeof entry === "string");
-}
-
-if (!existsSync(EXT)) {
-  console.error(`No extensions dir at ${EXT}`);
-  process.exit(1);
-}
-
-for (const name of readdirSync(EXT)) {
-  const root = join(EXT, name);
-  if (!isDir(root)) continue;
-  const manifestPath = join(root, ".agents", "plugin.json");
-  if (!existsSync(manifestPath)) continue;
-  const id = `extensions/${name}`;
-  let m;
-  try { m = JSON.parse(readFileSync(manifestPath, "utf8")); }
-  catch (e) { err(id, `unreadable .agents/plugin.json: ${e.message}`); continue; }
-
-  // E1 — no commands
-  if ("commands" in m) err(id, `manifest declares "commands" — commands are skills; remove it`);
-  if (isDir(join(root, "commands"))) err(id, `has a commands/ dir — commands are skills; migrate to skills/`);
-
-  // E4 — repo-wide surface targeting contract
-  const expectedTargets = ALL_SURFACE_TARGETS;
-  const actualTargets = normalizedTargets(m.targets);
-  if (!actualTargets) {
-    err(id, `manifest must declare "targets": ${JSON.stringify(expectedTargets)}`);
-  } else if (JSON.stringify(actualTargets) !== JSON.stringify(expectedTargets)) {
-    err(
-      id,
-      `targets must be ${JSON.stringify(expectedTargets)}; found ${JSON.stringify(actualTargets)}`,
-    );
-  }
-
-  // E2 — declare components that exist on disk
-  for (const comp of ["skills", "agents", "hooks"]) {
-    if (isDir(join(root, comp)) && !m[comp])
-      err(id, `${comp}/ exists on disk but manifest has no "${comp}" field → it will NOT install`);
-  }
-
-  // E3 — skill hygiene
-  const skillsDir = join(root, "skills");
-  if (isDir(skillsDir)) {
-    for (const s of readdirSync(skillsDir)) {
-      const sp = join(skillsDir, s);
-      if (!isDir(sp)) { warn(id, `skills/${s} is a loose file, not a skill dir`); continue; }
-      const smd = join(sp, "SKILL.md");
-      if (!existsSync(smd)) { err(id, `skills/${s} has no SKILL.md`); continue; }
-      const fm = frontmatter(smd);
-      if (!fm) err(id, `skills/${s}/SKILL.md has no YAML frontmatter`);
-      else {
-        if (!fm.name) err(id, `skills/${s}/SKILL.md frontmatter missing "name"`);
-        if (!fm.description) err(id, `skills/${s}/SKILL.md frontmatter missing "description"`);
-      }
-      if (existsSync(join(sp, "README.md"))) err(id, `skills/${s} contains README.md (not allowed in a skill)`);
-    }
-  }
-}
-
-for (const w of warnings) console.log(w);
-for (const e of errors) console.log(e);
-console.log(
-  errors.length
-    ? `\n✗ principles check FAILED: ${errors.length} error(s), ${warnings.length} warning(s)`
-    : `\n✓ principles check passed (${warnings.length} warning(s))`,
-);
-process.exit(errors.length ? 1 : 0);

package/scripts/hooks/session-start-drift-check.mjs

@@ -1,48 +0,0 @@
-#!/usr/bin/env node
-/**
- * session-start-drift-check.mjs — Enact Extensions session-start drift hook.
- *
- * Registered as a session-start hook for Claude, Codex, Cursor, and Enact.
- * Checks whether any installed enact-extensions plugins have drifted from
- * their canonical source (i.e. are outdated) and prints a concise advisory
- * if so. When the user opts in via ENACT_EXTENSIONS_AUTO_UPDATE, the drifted
- * surfaces are refreshed in place instead of merely advised.
- *
- * Design constraints:
- *   - FAIL-SILENT: wrap everything in try/catch; never throw; always exit 0.
- *   - FAST: imports the helper directly (no subprocess) for speed.
- *   - READ-ONLY by default: only mutates state when the user opts into auto-apply.
- *   - NO OUTPUT on success (or error): only print when there are outdated entries.
- *   - DEPENDENCY-FREE: only node builtins + enact-extensions own modules.
- */
-
-import { dirname, resolve, join } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-// Navigate from scripts/hooks/ up to the repo root so we can import lib modules.
-const REPO_ROOT = resolve(__dirname, "..", "..");
-
-try {
-  // Dynamically import so any module-load failure is caught by the outer try/catch.
-  const { handleSessionStartDrift } = await import(join(REPO_ROOT, "scripts", "lib", "auto-update.mjs"));
-
-  // Opt-in is the USER's: gate auto-apply on the env var they set.
-  const autoApply = !!process.env.ENACT_EXTENSIONS_AUTO_UPDATE;
-
-  let result;
-  try {
-    result = handleSessionStartDrift({ autoApply });
-  } catch {
-    // Drift resolution threw (ledger missing, I/O error, etc.) — stay silent.
-    process.exit(0);
-  }
-
-  if (result.line) {
-    process.stdout.write(`${result.line}\n`);
-  }
-} catch {
-  // Any top-level error (import failure, parse error, etc.) — silent exit 0.
-}
-
-process.exit(0);

package/scripts/install.sh

@@ -1,70 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-
-# ── Node.js version check ──────────────────────────────────────────────────────
-NODE_MAJOR="$(node --version 2>/dev/null | sed 's/v//' | cut -d. -f1)"
-if [ -z "$NODE_MAJOR" ] || [ "$NODE_MAJOR" -lt 22 ]; then
-  echo "error: Node.js >= 22 is required (found: $(node --version 2>/dev/null || echo 'none'))" >&2
-  exit 1
-fi
-
-cd "$REPO_ROOT"
-
-# ── Install dependencies ───────────────────────────────────────────────────────
-echo "→ npm install"
-npm install --no-audit --no-fund
-
-# ── Build TypeScript ───────────────────────────────────────────────────────────
-echo "→ npm run build"
-npm run build
-
-# ── Bundle into a single file ─────────────────────────────────────────────────
-echo "→ bundling"
-# Bundle the CLI and all JS/TS dependencies into one ESM file.
-# The bundle is installed into <support>/dist/internal/ so that import.meta.url
-# resolves ../../ to <support>/ — matching the dist/internal/schema.js assumption
-# about where spec/ lives relative to the compiled output.
-SUPPORT_DIR="$HOME/.local/share/enact-extensions"
-BUNDLE_DIR="$SUPPORT_DIR/dist/internal"
-mkdir -p "$BUNDLE_DIR"
-
-npx --yes esbuild scripts/enact-extensions.mjs \
-  --bundle \
-  --platform=node \
-  --format=cjs \
-  "--banner:js=const __import_meta_url=require('url').pathToFileURL(__filename).href;" \
-  "--define:import.meta.url=__import_meta_url" \
-  --outfile="$BUNDLE_DIR/enact-extensions.js"
-
-chmod +x "$BUNDLE_DIR/enact-extensions.js"
-
-# ── Copy spec/ alongside the bundle ───────────────────────────────────────────
-# schema.ts resolves spec/ as ../../spec/ relative to dist/internal/ — keep that layout.
-rm -rf "$SUPPORT_DIR/spec"
-cp -r "$REPO_ROOT/spec" "$SUPPORT_DIR/spec"
-
-# ── Install launcher ───────────────────────────────────────────────────────────
-if [ "$(id -u)" = "0" ]; then
-  INSTALL_DIR="/usr/local/bin"
-else
-  INSTALL_DIR="$HOME/.local/bin"
-  mkdir -p "$INSTALL_DIR"
-fi
-
-LAUNCHER="$INSTALL_DIR/enact-extensions"
-{
-  echo '#!/usr/bin/env bash'
-  echo "exec node \"$BUNDLE_DIR/enact-extensions.js\" \"\$@\""
-} > "$LAUNCHER"
-chmod +x "$LAUNCHER"
-
-echo ""
-echo "installed: $LAUNCHER"
-
-if [ "$(id -u)" != "0" ] && [[ ":$PATH:" != *":$HOME/.local/bin:"* ]]; then
-  echo ""
-  echo "  Add to your shell profile to use the command:"
-  echo "    export PATH=\"\$HOME/.local/bin:\$PATH\""
-fi

package/scripts/lib/auto-update.mjs

@@ -1,75 +0,0 @@
-/**
- * auto-update.mjs — SessionStart drift resolution: advise by default, or
- * auto-apply when opted in via ENACT_EXTENSIONS_AUTO_UPDATE.
- *
- * Single export:
- *   handleSessionStartDrift({ autoApply, home, cwd }) → { outdated, applied, updated, line }
- *
- * Behaviour:
- *   - Compute the outdated (drifted) surfaces from the ledger vs canonical source.
- *   - No outdated surfaces           → { outdated: [], applied: false, line: null }.
- *   - Outdated + autoApply=false     → advisory line (default; mutates nothing).
- *   - Outdated + autoApply=true      → runUpdate({ all: true }); summary line naming
- *                                      what was refreshed. If the refresh updated
- *                                      nothing actionable (e.g. all orphaned), fall
- *                                      back to the advisory line.
- *
- * The opt-in is the USER's: callers derive `autoApply` from
- * process.env.ENACT_EXTENSIONS_AUTO_UPDATE. This module never reads env itself.
- * Reuses computeOutdated + runUpdate; it adds no new install/refresh logic.
- */
-
-import { computeOutdated } from "./outdated.mjs";
-import { runUpdate } from "./run-update.mjs";
-
-/** Format the "name/platform, ..." pair list for a set of entries. */
-function pairs(entries) {
-  return entries.map((e) => `${e.name}/${e.platform}`).join(", ");
-}
-
-/** The default advisory line (unchanged wording: names surfaces + manual command). */
-export function driftAdvisoryLine(outdated) {
-  return (
-    `[enact-extensions] ${outdated.length} plugin surface${outdated.length === 1 ? "" : "s"} ` +
-    `outdated: ${pairs(outdated)}. Run: enact-extensions update --all`
-  );
-}
-
-/** The auto-apply summary line, naming the surfaces that were refreshed. */
-export function autoUpdateSummaryLine(updated) {
-  return (
-    `[enact-extensions] auto-updated ${updated.length} plugin surface${updated.length === 1 ? "" : "s"}: ` +
-    `${pairs(updated)}`
-  );
-}
-
-/**
- * Resolve SessionStart drift: advise by default, or auto-apply when opted in.
- *
- * @param {object} [opts]
- * @param {boolean} [opts.autoApply] — when true, refresh outdated surfaces in place.
- * @param {string}  [opts.home]      — ledger home override (defaults to os.homedir()).
- * @param {string}  [opts.cwd]       — canonical-source resolution dir (defaults to cwd).
- * @returns {{ outdated: object[], applied: boolean, updated: object[], line: string|null }}
- */
-export function handleSessionStartDrift({ autoApply, home, cwd } = {}) {
-  const outdated = (computeOutdated({ home, cwd }) ?? []).filter(
-    (e) => e && e.status === "outdated",
-  );
-
-  if (outdated.length === 0) {
-    return { outdated, applied: false, updated: [], line: null };
-  }
-
-  if (autoApply) {
-    const summary = runUpdate({ all: true, home, cwd });
-    const updated = summary?.updated ?? [];
-    if (updated.length === 0) {
-      // Nothing actionable was refreshed (e.g. orphaned source) — advise instead.
-      return { outdated, applied: false, updated, line: driftAdvisoryLine(outdated) };
-    }
-    return { outdated, applied: true, updated, line: autoUpdateSummaryLine(updated) };
-  }
-
-  return { outdated, applied: false, updated: [], line: driftAdvisoryLine(outdated) };
-}

package/scripts/lib/bundle-hash.mjs

@@ -1,137 +0,0 @@
-/**
- * bundle-hash.mjs — deterministic content hash for a plugin bundle.
- *
- * bundleHash(pluginRoot) → sha256 hex string
- *
- * The hash covers the CANONICAL bundle content only:
- *   - .agents/plugin.json (the manifest itself)
- *   - Component dirs/files referenced in the manifest:
- *       skills, mcpServers, apps, commands, hooks, agents, _agents, rules
- *   - .mcp.json (if present at pluginRoot root)
- *
- * EXCLUDED (generated / derived surfaces, never present in canonical source):
- *   - .claude-plugin/
- *   - .codex-plugin/
- *   - .cursor-plugin/
- *
- * Algorithm:
- *   1. Collect the set of paths to include (manifest + referenced component paths).
- *   2. Walk each path recursively; collect all (relativePath, bytes) pairs.
- *   3. Sort by relative path (order-independence).
- *   4. Feed path + bytes for each file into a single sha256 digest.
- *   5. Return the hex digest.
- *
- * Pure, no writes, synchronous.
- */
-
-import { createHash } from "node:crypto";
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
-import { join, relative } from "node:path";
-
-// ---------------------------------------------------------------------------
-// Canonical component field names (mirrors pathFieldsFromManifest in install.ts)
-// ---------------------------------------------------------------------------
-const COMPONENT_FIELDS = [
-  "skills",
-  "mcpServers",
-  "apps",
-  "commands",
-  "hooks",
-  "agents",
-  "_agents",
-  "rules",
-];
-
-// Generated platform dirs — always excluded from the canonical hash.
-const EXCLUDED_DIRS = new Set([".claude-plugin", ".codex-plugin", ".cursor-plugin"]);
-
-/**
- * Recursively collect all file entries under `root`.
- * Returns an array of { rel: string, abs: string } sorted by rel.
- * Silently skips non-file, non-directory entries.
- *
- * @param {string} abs - absolute path to walk
- * @param {string} base - the pluginRoot (for computing relative paths)
- * @param {string[]} acc - accumulator
- */
-function walkFiles(abs, base, acc) {
-  if (!existsSync(abs)) return;
-  const stat = statSync(abs);
-  if (stat.isFile()) {
-    acc.push(relative(base, abs));
-    return;
-  }
-  if (!stat.isDirectory()) return;
-  const entries = readdirSync(abs).sort(); // sort for determinism
-  for (const name of entries) {
-    walkFiles(join(abs, name), base, acc);
-  }
-}
-
-/**
- * Collect the canonical set of relative paths to include in the hash.
- *
- * @param {string} pluginRoot
- * @param {object} manifest - parsed .agents/plugin.json
- * @returns {string[]} sorted relative paths (relative to pluginRoot)
- */
-function canonicalPaths(pluginRoot, manifest) {
-  // Always include the manifest itself.
-  const collected = [];
-
-  // 1. Always walk .agents/plugin.json (the manifest).
-  walkFiles(join(pluginRoot, ".agents", "plugin.json"), pluginRoot, collected);
-
-  // 2. Walk each component path that exists.
-  for (const field of COMPONENT_FIELDS) {
-    const raw = manifest[field];
-    if (typeof raw !== "string" || !raw.trim()) continue;
-    // Normalise: strip leading ./ and trailing /
-    const cleaned = raw.replace(/^\.\//, "").replace(/\/+$/, "");
-    if (!cleaned || cleaned.startsWith("../")) continue;
-    // Refuse to hash generated platform dirs even if the manifest references them.
-    const topSegment = cleaned.split("/")[0];
-    if (EXCLUDED_DIRS.has(topSegment)) continue;
-    walkFiles(join(pluginRoot, cleaned), pluginRoot, collected);
-  }
-
-  // 3. .mcp.json at pluginRoot root (included if present, regardless of manifest field)
-  walkFiles(join(pluginRoot, ".mcp.json"), pluginRoot, collected);
-
-  // Sort for order-independence, then deduplicate.
-  const unique = [...new Set(collected)].sort();
-  return unique;
-}
-
-/**
- * Compute a deterministic sha256 hex hash of the canonical plugin bundle.
- *
- * @param {string} pluginRoot - absolute path to the bundle root
- * @returns {string} sha256 hex digest (64 lowercase hex chars)
- * @throws {Error} if the manifest cannot be read (ENOENT, parse error, etc.)
- */
-export function bundleHash(pluginRoot) {
-  // Read and parse the manifest first — this is the anchor; if it's missing
-  // we cannot know which component paths to include, so we throw.
-  const manifestPath = join(pluginRoot, ".agents", "plugin.json");
-  if (!existsSync(manifestPath)) {
-    throw new Error(`Cannot compute bundle hash: manifest not found at ${manifestPath}`);
-  }
-  const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-
-  // Collect the sorted list of relative paths.
-  const paths = canonicalPaths(pluginRoot, manifest);
-
-  // Hash all paths and their contents in sorted order.
-  const hash = createHash("sha256");
-  for (const rel of paths) {
-    const abs = join(pluginRoot, rel);
-    // Feed the relative path as a NUL-terminated string to make path changes
-    // visible even when content is identical.
-    hash.update(rel + "\0", "utf8");
-    // Feed the file bytes.
-    hash.update(readFileSync(abs));
-  }
-
-  return hash.digest("hex");
-}