@amsterdamdatalabs/enact-extensions 0.1.47 → 0.1.49

package/scripts/enact-extensions.mjs

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
-import { resolveBundlePath } from "./lib/resolve-bundle.mjs";
-import { listBundles } from "./lib/list-bundles.mjs";
-import { buildIndex } from "./lib/build-index.mjs";
-import { runValidate } from "./lib/run-validate.mjs";
-import { runSync } from "./lib/run-sync.mjs";
-import { runRepoInstall, runRepoUninstall } from "./lib/run-repo-install.mjs";
-import { runRepoDoctor } from "./lib/run-repo-doctor.mjs";
-import { dirname, join, resolve } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
+import { dirname, join, resolve } from "node:path";
 import { cwd as processCwd } from "node:process";
+import { fileURLToPath } from "node:url";
 import { Ajv } from "ajv";
 import addFormatsModule from "ajv-formats";
+import { buildIndex } from "./lib/build-index.mjs";
+import { listBundles } from "./lib/list-bundles.mjs";
+import { resolveBundlePath } from "./lib/resolve-bundle.mjs";
+import { runRepoDoctor } from "./lib/run-repo-doctor.mjs";
+import { runRepoInstall, runRepoUninstall } from "./lib/run-repo-install.mjs";
+import { runSync } from "./lib/run-sync.mjs";
+import { runValidate } from "./lib/run-validate.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PACKAGE_ROOT = resolve(__dirname, "..");
@@ -44,7 +44,7 @@ Usage:
                                           the real run would have. Touches nothing.
   enact-extensions uninstall <name> --repo <path> [--purge] [--force]
                                           Remove exactly what the repo lock records (--purge also removes
-                                          the [skills] block install wrote to enact-config.toml, and the
+                                          the [extensions] block install wrote to enact-config.toml, and the
                                           file itself if install created it and only version = 1 remains)
   enact-extensions uninstall <name> --repo <path> --dry-run [--purge]
                                           Print exactly what uninstall would remove/restore, per file
@@ -56,7 +56,7 @@ Usage:
                                           (missing/drifted managed files), per-host status (claude,
                                           codex incl. trust_level, cursor, kimi incl. workspace-trust,
                                           opencode), required global binaries on PATH, the
-                                          enact-config.toml marker ([skills] present; a stale
+                                          enact-config.toml marker ([extensions] present; a stale
                                           .agents/enact-repo.toml is reported), an "enact-hook doctor
                                           --repo" passthrough when available, and the enact-hook
                                           deny/activity log paths, existence, row counts, and (deny
@@ -80,7 +80,7 @@ Options:
                            exit with the same success/failure the real run would have. Writes nothing.
   --force                  (install/uninstall --repo) Overwrite user-edited managed content and take over
                            same-named entries not owned by the bundle. Never overwrites a user skill dir.
-  --purge                  (uninstall --repo) Also remove the [skills] block install wrote to enact-config.toml.
+  --purge                  (uninstall --repo) Also remove the [extensions] block install wrote to enact-config.toml.
 
 Name resolution (bare plugin names):
   When a bare name (no "/" in it) is given, it is resolved in this order:
@@ -175,349 +175,377 @@ function parseArgs(argv) {
 }
 
 try {
-const rawArgv = process.argv.slice(2);
-if (rawArgv.length === 1 && (rawArgv[0] === "-v" || rawArgv[0] === "--version")) {
-  console.log(`enact-extensions ${VERSION}`);
-  exit(0);
-}
-
-const { command, path, options, unknown } = parseArgs(rawArgv);
-
-if (!command || command === "help") {
-  console.log(HELP);
-  exit(command ? 0 : 1);
-}
-
-if (!COMMANDS.has(command)) {
-  console.error(`Unknown command: ${command}\n\n${REPO_USAGE_HINT}\nRun enact-extensions --help for usage.`);
-  exit(1);
-}
+  const rawArgv = process.argv.slice(2);
+  if (rawArgv.length === 1 && (rawArgv[0] === "-v" || rawArgv[0] === "--version")) {
+    console.log(`enact-extensions ${VERSION}`);
+    exit(0);
+  }
 
-if (unknown.length > 0) {
-  fail(`Unknown option(s) for ${command}: ${unknown.join(", ")}\n${REPO_USAGE_HINT}`);
-}
+  const { command, path, options, unknown } = parseArgs(rawArgv);
 
-if ((command === "install" || command === "uninstall") && !options.repo) {
-  fail(`${command} requires --repo <path>.\n${REPO_USAGE_HINT}`);
-}
+  if (!command || command === "help") {
+    console.log(HELP);
+    exit(command ? 0 : 1);
+  }
 
-if (!["install", "uninstall"].includes(command) && (options.force || options.purge || options.host || options.dryRun)) {
-  fail("--host/--force/--purge/--dry-run only apply to install|uninstall <name> --repo <path>");
-}
+  if (!COMMANDS.has(command)) {
+    console.error(`Unknown command: ${command}\n\n${REPO_USAGE_HINT}\nRun enact-extensions --help for usage.`);
+    exit(1);
+  }
 
-function printRepoDoctorReport(report) {
-  const ok = (b) => (b ? "OK" : "FAIL");
-  console.log(`[doctor enact-repo] repo: ${report.repo}`);
-  console.log(`  installed: ${report.installed ? "yes" : "NO"}`);
-  if (!report.installed) {
-    for (const p of report.problems) console.error(`  problem: ${p}`);
-    return;
+  if (unknown.length > 0) {
+    fail(`Unknown option(s) for ${command}: ${unknown.join(", ")}\n${REPO_USAGE_HINT}`);
   }
-  console.log(
-    `  version: installed=${report.version.installed} bundle=${report.version.bundle ?? "(unknown)"} outdated=${report.version.outdated ? "YES" : "no"}`,
-  );
-  if (report.version.contentOutdated.length > 0) {
-    console.log(`    content drifted from current bundle (${report.version.contentOutdated.length}): ${report.version.contentOutdated.join(", ")}`);
+
+  if ((command === "install" || command === "uninstall") && !options.repo) {
+    fail(`${command} requires --repo <path>.\n${REPO_USAGE_HINT}`);
   }
-  if (report.version.note) console.log(`    note: ${report.version.note}`);
-
-  console.log(`  lock integrity: ${ok(report.lock.valid)}`);
-  if (!report.lock.valid) {
-    if (report.lock.missingFiles.length) console.log(`    missing: ${report.lock.missingFiles.join(", ")}`);
-    if (report.lock.driftedFiles.length) console.log(`    drifted: ${report.lock.driftedFiles.join(", ")}`);
-    if (report.lock.jsonIssues.length) console.log(`    json: ${report.lock.jsonIssues.join(", ")}`);
-    if (report.lock.tomlIssues.length) console.log(`    toml: ${report.lock.tomlIssues.join(", ")}`);
+
+  if (
+    !["install", "uninstall"].includes(command) &&
+    (options.force || options.purge || options.host || options.dryRun)
+  ) {
+    fail("--host/--force/--purge/--dry-run only apply to install|uninstall <name> --repo <path>");
   }
 
-  for (const [host, info] of Object.entries(report.hosts)) {
-    console.log(`  host ${host}: targeted=${info.targeted} present=${info.targeted ? ok(info.present) : "n/a"}`);
-    if (info.note) console.log(`    ${info.note}`);
-    if (info.trust) {
-      console.log(`    codex trust_level: ${info.trust.trustLevel ?? "(none)"}${info.trust.note ? ` -- ${info.trust.note}` : ""}`);
+  function printRepoDoctorReport(report) {
+    const ok = (b) => (b ? "OK" : "FAIL");
+    console.log(`[doctor enact-repo] repo: ${report.repo}`);
+    console.log(`  installed: ${report.installed ? "yes" : "NO"}`);
+    if (!report.installed) {
+      for (const p of report.problems) console.error(`  problem: ${p}`);
+      return;
     }
-    if (info.globalHooksNote) console.log(`    ${info.globalHooksNote}`);
-    if (info.workspaceTrust) {
+    console.log(
+      `  version: installed=${report.version.installed} bundle=${report.version.bundle ?? "(unknown)"} outdated=${report.version.outdated ? "YES" : "no"}`,
+    );
+    if (report.version.contentOutdated.length > 0) {
       console.log(
-        `    kimi workspace trust: ${info.workspaceTrust.trusted ? "TRUSTED" : "NOT TRUSTED"}${info.workspaceTrust.note ? ` -- ${info.workspaceTrust.note}` : ""}`,
+        `    content drifted from current bundle (${report.version.contentOutdated.length}): ${report.version.contentOutdated.join(", ")}`,
       );
     }
-    if (host === "opencode" && info.targeted) {
-      console.log(
-        `    generated from current bundle: ${info.generatedFromCurrentBundle === false ? "NO (stale)" : info.generatedFromCurrentBundle === true ? "yes" : "n/a"}`,
-      );
+    if (report.version.note) console.log(`    note: ${report.version.note}`);
+
+    console.log(`  lock integrity: ${ok(report.lock.valid)}`);
+    if (!report.lock.valid) {
+      if (report.lock.missingFiles.length) console.log(`    missing: ${report.lock.missingFiles.join(", ")}`);
+      if (report.lock.driftedFiles.length) console.log(`    drifted: ${report.lock.driftedFiles.join(", ")}`);
+      if (report.lock.jsonIssues.length) console.log(`    json: ${report.lock.jsonIssues.join(", ")}`);
+      if (report.lock.tomlIssues.length) console.log(`    toml: ${report.lock.tomlIssues.join(", ")}`);
     }
-  }
-
-  console.log("  binaries:");
-  for (const [bin, info] of Object.entries(report.binaries)) {
-    console.log(`    ${bin}: ${info.found ? `${info.version ?? "(unknown version)"} @ ${info.path}` : "NOT FOUND"}`);
-  }
 
-  console.log(`  marker (${report.marker.path}): ${ok(report.marker.valid)}${report.marker.note ? ` -- ${report.marker.note}` : ""}`);
-  if (report.staleMarker.present) console.log(`  stale marker (${report.staleMarker.path}): ${report.staleMarker.note}`);
+    for (const [host, info] of Object.entries(report.hosts)) {
+      console.log(`  host ${host}: targeted=${info.targeted} present=${info.targeted ? ok(info.present) : "n/a"}`);
+      if (info.note) console.log(`    ${info.note}`);
+      if (info.trust) {
+        console.log(
+          `    codex trust_level: ${info.trust.trustLevel ?? "(none)"}${info.trust.note ? ` -- ${info.trust.note}` : ""}`,
+        );
+      }
+      if (info.globalHooksNote) console.log(`    ${info.globalHooksNote}`);
+      if (info.workspaceTrust) {
+        console.log(
+          `    kimi workspace trust: ${info.workspaceTrust.trusted ? "TRUSTED" : "NOT TRUSTED"}${info.workspaceTrust.note ? ` -- ${info.workspaceTrust.note}` : ""}`,
+        );
+      }
+      if (host === "opencode" && info.targeted) {
+        console.log(
+          `    generated from current bundle: ${info.generatedFromCurrentBundle === false ? "NO (stale)" : info.generatedFromCurrentBundle === true ? "yes" : "n/a"}`,
+        );
+      }
+    }
 
-  console.log(`  enact-hook doctor --repo: ${report.hookDoctor.available ? `exit ${report.hookDoctor.exitCode}` : `not available -- ${report.hookDoctor.note}`}`);
-  if (report.hookDoctor.available && report.hookDoctor.stdout) {
-    for (const line of report.hookDoctor.stdout.trim().split("\n")) {
-      if (line) console.log(`    ${line}`);
+    console.log("  binaries:");
+    for (const [bin, info] of Object.entries(report.binaries)) {
+      console.log(`    ${bin}: ${info.found ? `${info.version ?? "(unknown version)"} @ ${info.path}` : "NOT FOUND"}`);
     }
-  }
 
-  if (report.hookLogs) {
-    const { denyLog, activityLog } = report.hookLogs;
     console.log(
-      `  hook logs: ${denyLog.path} ${denyLog.exists ? `(${denyLog.rowCount} row(s))` : "(not present)"}; ${activityLog.path} ${activityLog.exists ? `(${activityLog.rowCount} row(s))` : "(not present)"}`,
+      `  marker (${report.marker.path}): ${ok(report.marker.valid)}${report.marker.note ? ` -- ${report.marker.note}` : ""}`,
     );
-    if (denyLog.lastRows.length > 0) {
-      console.log(`    last ${denyLog.lastRows.length} deny row(s):`);
-      for (const row of denyLog.lastRows) {
-        console.log(`      ${row.timestamp} ${row.surface} ${row.reason_id} ${row.command} ${row.agent_message}`);
+    if (report.staleMarker.present)
+      console.log(`  stale marker (${report.staleMarker.path}): ${report.staleMarker.note}`);
+
+    console.log(
+      `  enact-hook doctor --repo: ${report.hookDoctor.available ? `exit ${report.hookDoctor.exitCode}` : `not available -- ${report.hookDoctor.note}`}`,
+    );
+    if (report.hookDoctor.available && report.hookDoctor.stdout) {
+      for (const line of report.hookDoctor.stdout.trim().split("\n")) {
+        if (line) console.log(`    ${line}`);
       }
     }
-  }
 
-  if (report.problems.length > 0) {
-    console.error(`[doctor enact-repo] ${report.problems.length} problem(s):`);
-    for (const p of report.problems) console.error(`  - ${p}`);
-  } else {
-    console.log("[doctor enact-repo] all hard requirements OK");
-  }
-}
+    if (report.hookLogs) {
+      const { denyLog, activityLog } = report.hookLogs;
+      console.log(
+        `  hook logs: ${denyLog.path} ${denyLog.exists ? `(${denyLog.rowCount} row(s))` : "(not present)"}; ${activityLog.path} ${activityLog.exists ? `(${activityLog.rowCount} row(s))` : "(not present)"}`,
+      );
+      if (denyLog.lastRows.length > 0) {
+        console.log(`    last ${denyLog.lastRows.length} deny row(s):`);
+        for (const row of denyLog.lastRows) {
+          console.log(`      ${row.timestamp} ${row.surface} ${row.reason_id} ${row.command} ${row.agent_message}`);
+        }
+      }
+    }
 
-// ---------------------------------------------------------------------------
-// `doctor <plugin> --repo <path>` — read-only repo-local health check.
-// Any plugin, bundled or not: bundled-extensions.json is the DEFAULT set, not
-// an allow-list. `<plugin>` is a bundled name or an explicit path, resolved
-// exactly like install/uninstall.
-// ---------------------------------------------------------------------------
-if (command === "doctor") {
-  if (!path || !options.repo) {
-    fail(`doctor requires: doctor <plugin> --repo <path> [--json]\n${REPO_USAGE_HINT}`);
-  }
-  let pluginRoot;
-  try {
-    pluginRoot = resolveBundlePath(path);
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    exit(1);
-  }
-  let report;
-  try {
-    report = runRepoDoctor(pluginRoot, { repo: options.repo });
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    exit(1);
-  }
-  if (options.json) {
-    console.log(JSON.stringify(report, null, 2));
-  } else {
-    printRepoDoctorReport(report);
+    if (report.problems.length > 0) {
+      console.error(`[doctor enact-repo] ${report.problems.length} problem(s):`);
+      for (const p of report.problems) console.error(`  - ${p}`);
+    } else {
+      console.log("[doctor enact-repo] all hard requirements OK");
+    }
   }
-  exit(report.exitCode);
-}
 
-// ---------------------------------------------------------------------------
-// `list` command — enumerate available plugin bundles.
-// ---------------------------------------------------------------------------
-if (command === "list") {
-  // The package's own extensions/ dir, resolved relative to this script.
-  const PACKAGE_ROOT = resolve(__dirname, "..");
-  const packageExtensions = join(PACKAGE_ROOT, "extensions");
-
-  let roots;
-  if (path) {
-    // Explicit dir argument → scan only that dir.
-    roots = [resolve(processCwd(), path)];
-  } else {
-    // Default: package-bundled extensions/ + cwd/extensions/ (if it differs).
-    roots = [packageExtensions];
-    const cwdExtensions = join(processCwd(), "extensions");
-    if (resolve(cwdExtensions) !== resolve(packageExtensions) && existsSync(cwdExtensions)) {
-      roots.push(cwdExtensions);
+  // ---------------------------------------------------------------------------
+  // `doctor <plugin> --repo <path>` — read-only repo-local health check.
+  // Any plugin, bundled or not: bundled-extensions.json is the DEFAULT set, not
+  // an allow-list. `<plugin>` is a bundled name or an explicit path, resolved
+  // exactly like install/uninstall.
+  // ---------------------------------------------------------------------------
+  if (command === "doctor") {
+    if (!path || !options.repo) {
+      fail(`doctor requires: doctor <plugin> --repo <path> [--json]\n${REPO_USAGE_HINT}`);
+    }
+    let pluginRoot;
+    try {
+      pluginRoot = resolveBundlePath(path);
+    } catch (err) {
+      console.error(err instanceof Error ? err.message : String(err));
+      exit(1);
+    }
+    let report;
+    try {
+      report = runRepoDoctor(pluginRoot, { repo: options.repo });
+    } catch (err) {
+      console.error(err instanceof Error ? err.message : String(err));
+      exit(1);
     }
+    if (options.json) {
+      console.log(JSON.stringify(report, null, 2));
+    } else {
+      printRepoDoctorReport(report);
+    }
+    exit(report.exitCode);
   }
 
-  const entries = listBundles(roots);
+  // ---------------------------------------------------------------------------
+  // `list` command — enumerate available plugin bundles.
+  // ---------------------------------------------------------------------------
+  if (command === "list") {
+    // The package's own extensions/ dir, resolved relative to this script.
+    const PACKAGE_ROOT = resolve(__dirname, "..");
+    const packageExtensions = join(PACKAGE_ROOT, "extensions");
+
+    let roots;
+    if (path) {
+      // Explicit dir argument → scan only that dir.
+      roots = [resolve(processCwd(), path)];
+    } else {
+      // Default: package-bundled extensions/ + cwd/extensions/ (if it differs).
+      roots = [packageExtensions];
+      const cwdExtensions = join(processCwd(), "extensions");
+      if (resolve(cwdExtensions) !== resolve(packageExtensions) && existsSync(cwdExtensions)) {
+        roots.push(cwdExtensions);
+      }
+    }
 
-  if (options.json) {
-    console.log(JSON.stringify(entries, null, 2));
-    exit(0);
-  }
+    const entries = listBundles(roots);
 
-  // Human-readable table.
-  const TRUNC = 60;
-  function trunc(str, len) {
-    if (!str) return "";
-    return str.length > len ? str.slice(0, len - 1) + "…" : str;
-  }
+    if (options.json) {
+      console.log(JSON.stringify(entries, null, 2));
+      exit(0);
+    }
 
-  if (entries.length === 0) {
-    console.log("No plugin bundles found.");
-    exit(0);
-  }
+    // Human-readable table.
+    const TRUNC = 60;
+    function trunc(str, len) {
+      if (!str) return "";
+      return str.length > len ? str.slice(0, len - 1) + "…" : str;
+    }
+
+    if (entries.length === 0) {
+      console.log("No plugin bundles found.");
+      exit(0);
+    }
+
+    // Header.
+    const COL_NAME = 28;
+    const COL_VER = 8;
+    const COL_CAT = 18;
+    const COL_SURF = 22;
 
-  // Header.
-  const COL_NAME = 28;
-  const COL_VER  = 8;
-  const COL_CAT  = 18;
-  const COL_SURF = 22;
-
-  function padR(str, n) { return String(str ?? "").padEnd(n).slice(0, n); }
-
-  const hr = "─".repeat(COL_NAME + COL_VER + COL_CAT + COL_SURF + 3 + TRUNC);
-  console.log(hr);
-  console.log(
-    padR("Name", COL_NAME) + "  " +
-    padR("Ver", COL_VER) + "  " +
-    padR("Category", COL_CAT) + "  " +
-    padR("Surfaces", COL_SURF) + "  " +
-    "Description"
-  );
-  console.log(hr);
-
-  for (const e of entries) {
-    const surfaces = e.targets.join(", ");
+    function padR(str, n) {
+      return String(str ?? "")
+        .padEnd(n)
+        .slice(0, n);
+    }
+
+    const hr = "─".repeat(COL_NAME + COL_VER + COL_CAT + COL_SURF + 3 + TRUNC);
+    console.log(hr);
     console.log(
-      padR(e.name, COL_NAME) + "  " +
-      padR(e.version, COL_VER) + "  " +
-      padR(e.category, COL_CAT) + "  " +
-      padR(surfaces, COL_SURF) + "  " +
-      trunc(e.description, TRUNC)
+      padR("Name", COL_NAME) +
+        "  " +
+        padR("Ver", COL_VER) +
+        "  " +
+        padR("Category", COL_CAT) +
+        "  " +
+        padR("Surfaces", COL_SURF) +
+        "  " +
+        "Description",
     );
-  }
-  console.log(hr);
-  console.log(`${entries.length} bundle${entries.length === 1 ? "" : "s"} found.`);
-  exit(0);
-}
+    console.log(hr);
 
-// ---------------------------------------------------------------------------
-// `index` command — generate a discovery index of all plugin bundles.
-//
-// The index is a LOCAL GENERATED ARTIFACT (never committed). The generated/
-// directory is gitignored. The schema at spec/index.json is the committed
-// contract. No network, no marketplace, no catalog/ — purely local.
-// ---------------------------------------------------------------------------
-if (command === "index") {
-  const PACKAGE_ROOT = resolve(__dirname, "..");
-  const packageExtensions = join(PACKAGE_ROOT, "extensions");
-
-  // Same default roots as `list`.
-  const roots = [packageExtensions];
-  const cwdExtensions = join(processCwd(), "extensions");
-  if (resolve(cwdExtensions) !== resolve(packageExtensions) && existsSync(cwdExtensions)) {
-    roots.push(cwdExtensions);
+    for (const e of entries) {
+      const surfaces = e.targets.join(", ");
+      console.log(
+        padR(e.name, COL_NAME) +
+          "  " +
+          padR(e.version, COL_VER) +
+          "  " +
+          padR(e.category, COL_CAT) +
+          "  " +
+          padR(surfaces, COL_SURF) +
+          "  " +
+          trunc(e.description, TRUNC),
+      );
+    }
+    console.log(hr);
+    console.log(`${entries.length} bundle${entries.length === 1 ? "" : "s"} found.`);
+    exit(0);
   }
 
-  // Build the index. The wall-clock timestamp is computed here at the CLI
-  // boundary and passed in — buildIndex itself stays pure (never calls Date).
-  let index;
-  try {
-    index = buildIndex(roots, { now: new Date().toISOString(), packageRoot: PACKAGE_ROOT });
-  } catch (err) {
-    console.error(`[enact-extensions index] Failed to build index: ${err instanceof Error ? err.message : String(err)}`);
-    exit(1);
-  }
+  // ---------------------------------------------------------------------------
+  // `index` command — generate a discovery index of all plugin bundles.
+  //
+  // The index is a LOCAL GENERATED ARTIFACT (never committed). The generated/
+  // directory is gitignored. The schema at spec/index.json is the committed
+  // contract. No network, no marketplace, no catalog/ — purely local.
+  // ---------------------------------------------------------------------------
+  if (command === "index") {
+    const PACKAGE_ROOT = resolve(__dirname, "..");
+    const packageExtensions = join(PACKAGE_ROOT, "extensions");
+
+    // Same default roots as `list`.
+    const roots = [packageExtensions];
+    const cwdExtensions = join(processCwd(), "extensions");
+    if (resolve(cwdExtensions) !== resolve(packageExtensions) && existsSync(cwdExtensions)) {
+      roots.push(cwdExtensions);
+    }
 
-  // Validate against spec/index.json before writing.
-  const schemaPath = join(PACKAGE_ROOT, "spec", "index.json");
-  let schema;
-  try {
-    schema = JSON.parse(readFileSync(schemaPath, "utf8"));
-  } catch (err) {
-    console.error(`[enact-extensions index] Cannot read schema ${schemaPath}: ${err instanceof Error ? err.message : String(err)}`);
-    exit(1);
-  }
+    // Build the index. The wall-clock timestamp is computed here at the CLI
+    // boundary and passed in — buildIndex itself stays pure (never calls Date).
+    let index;
+    try {
+      index = buildIndex(roots, { now: new Date().toISOString(), packageRoot: PACKAGE_ROOT });
+    } catch (err) {
+      console.error(
+        `[enact-extensions index] Failed to build index: ${err instanceof Error ? err.message : String(err)}`,
+      );
+      exit(1);
+    }
 
-  const addFormats = addFormatsModule.default ?? addFormatsModule;
-  const ajv = new Ajv({ allErrors: true, strict: false });
-  addFormats(ajv);
-  const validate = ajv.compile(schema);
-  const valid = validate(index);
-  if (!valid) {
-    const errs = (validate.errors ?? []).map((e) => `  ${e.instancePath || "/"}: ${e.message}`).join("\n");
-    console.error(`[enact-extensions index] Generated index failed schema validation:\n${errs}`);
-    exit(1);
-  }
+    // Validate against spec/index.json before writing.
+    const schemaPath = join(PACKAGE_ROOT, "spec", "index.json");
+    let schema;
+    try {
+      schema = JSON.parse(readFileSync(schemaPath, "utf8"));
+    } catch (err) {
+      console.error(
+        `[enact-extensions index] Cannot read schema ${schemaPath}: ${err instanceof Error ? err.message : String(err)}`,
+      );
+      exit(1);
+    }
 
-  const json = JSON.stringify(index, null, 2);
-  // --stdout is normalized to "-" during arg parsing, so this single check covers both.
-  const toStdout = options.out === "-";
-
-  if (toStdout) {
-    // Write JSON to stdout; summary to stderr (keeps stdout pipe-clean).
-    process.stdout.write(json + "\n");
-    process.stderr.write(`[enact-extensions index] ${index.count} plugin${index.count === 1 ? "" : "s"} indexed.\n`);
-  } else {
-    const outPath = options.out
-      ? resolve(processCwd(), options.out)
-      : join(PACKAGE_ROOT, "generated", "index.json");
-
-    // Ensure parent directory exists.
-    const outDir = resolve(outPath, "..");
-    mkdirSync(outDir, { recursive: true });
-
-    writeFileSync(outPath, json + "\n", "utf8");
-    process.stderr.write(`[enact-extensions index] Wrote ${index.count} plugin${index.count === 1 ? "" : "s"} to ${outPath}\n`);
-  }
+    const addFormats = addFormatsModule.default ?? addFormatsModule;
+    const ajv = new Ajv({ allErrors: true, strict: false });
+    addFormats(ajv);
+    const validate = ajv.compile(schema);
+    const valid = validate(index);
+    if (!valid) {
+      const errs = (validate.errors ?? []).map((e) => `  ${e.instancePath || "/"}: ${e.message}`).join("\n");
+      console.error(`[enact-extensions index] Generated index failed schema validation:\n${errs}`);
+      exit(1);
+    }
 
-  exit(0);
-}
+    const json = JSON.stringify(index, null, 2);
+    // --stdout is normalized to "-" during arg parsing, so this single check covers both.
+    const toStdout = options.out === "-";
 
-// ---------------------------------------------------------------------------
-// Commands that resolve a plugin root path: validate, sync, install/uninstall --repo.
-// ---------------------------------------------------------------------------
-let pluginRoot = null;
-try {
-  pluginRoot = path ? resolveBundlePath(path) : resolve(processCwd());
-} catch (err) {
-  // uninstall --repo must work even when the source bundle is gone: a bare
-  // name that does not resolve is used verbatim as the plugin name.
-  const isBareName = typeof path === "string" && path.length > 0 && !path.includes("/") && !path.includes("\\");
-  if (!(command === "uninstall" && isBareName)) {
-    fail(err instanceof Error ? err.message : String(err));
-  }
-}
+    if (toStdout) {
+      // Write JSON to stdout; summary to stderr (keeps stdout pipe-clean).
+      process.stdout.write(json + "\n");
+      process.stderr.write(`[enact-extensions index] ${index.count} plugin${index.count === 1 ? "" : "s"} indexed.\n`);
+    } else {
+      const outPath = options.out ? resolve(processCwd(), options.out) : join(PACKAGE_ROOT, "generated", "index.json");
 
-function manifestName(root) {
-  const manifestPath = root ? join(root, ".agents", "plugin.json") : null;
-  return manifestPath && existsSync(manifestPath) ? JSON.parse(readFileSync(manifestPath, "utf8")).name : null;
-}
+      // Ensure parent directory exists.
+      const outDir = resolve(outPath, "..");
+      mkdirSync(outDir, { recursive: true });
 
-try {
-  if (command === "validate") {
-    const ok = runValidate(pluginRoot, undefined, { pluginValidate: true, skillValidate: true });
-    exit(ok ? 0 : 1);
-  }
+      writeFileSync(outPath, json + "\n", "utf8");
+      process.stderr.write(
+        `[enact-extensions index] Wrote ${index.count} plugin${index.count === 1 ? "" : "s"} to ${outPath}\n`,
+      );
+    }
 
-  if (command === "sync") {
-    runSync(pluginRoot, { name: options.name });
     exit(0);
   }
 
-  // install | uninstall --repo
-  const dryRun = options.dryRun === true;
-  const repoPluginName = manifestName(pluginRoot) ?? path;
-  if (!repoPluginName) {
-    fail(`${command} --repo requires a plugin name`);
+  // ---------------------------------------------------------------------------
+  // Commands that resolve a plugin root path: validate, sync, install/uninstall --repo.
+  // ---------------------------------------------------------------------------
+  let pluginRoot = null;
+  try {
+    pluginRoot = path ? resolveBundlePath(path) : resolve(processCwd());
+  } catch (err) {
+    // uninstall --repo must work even when the source bundle is gone: a bare
+    // name that does not resolve is used verbatim as the plugin name.
+    const isBareName = typeof path === "string" && path.length > 0 && !path.includes("/") && !path.includes("\\");
+    if (!(command === "uninstall" && isBareName)) {
+      fail(err instanceof Error ? err.message : String(err));
+    }
   }
-  const result =
-    command === "install"
-      ? runRepoInstall(pluginRoot, { repo: options.repo, host: options.host, force: options.force, dryRun })
-      : runRepoUninstall(repoPluginName, { repo: options.repo, purge: options.purge, force: options.force, dryRun });
-  if (dryRun) {
-    if (result.actions.length === 0) {
-      console.log("[dry-run] no filesystem changes — nothing touched");
-    } else {
-      for (const a of result.actions) {
-        console.log(`[dry-run] would ${a.action}: ${a.file} — ${a.reason}`);
+
+  function manifestName(root) {
+    const manifestPath = root ? join(root, ".agents", "plugin.json") : null;
+    return manifestPath && existsSync(manifestPath) ? JSON.parse(readFileSync(manifestPath, "utf8")).name : null;
+  }
+
+  try {
+    if (command === "validate") {
+      const ok = runValidate(pluginRoot, undefined, { pluginValidate: true, skillValidate: true });
+      exit(ok ? 0 : 1);
+    }
+
+    if (command === "sync") {
+      runSync(pluginRoot, { name: options.name });
+      exit(0);
+    }
+
+    // install | uninstall --repo
+    const dryRun = options.dryRun === true;
+    const repoPluginName = manifestName(pluginRoot) ?? path;
+    if (!repoPluginName) {
+      fail(`${command} --repo requires a plugin name`);
+    }
+    const result =
+      command === "install"
+        ? runRepoInstall(pluginRoot, { repo: options.repo, host: options.host, force: options.force, dryRun })
+        : runRepoUninstall(repoPluginName, { repo: options.repo, purge: options.purge, force: options.force, dryRun });
+    if (dryRun) {
+      if (result.actions.length === 0) {
+        console.log("[dry-run] no filesystem changes — nothing touched");
+      } else {
+        for (const a of result.actions) {
+          console.log(`[dry-run] would ${a.action}: ${a.file} — ${a.reason}`);
+        }
       }
     }
+    exit(0);
+  } catch (err) {
+    if (err instanceof ExitSignal) throw err;
+    fail(err instanceof Error ? err.message : String(err));
   }
-  exit(0);
-} catch (err) {
-  if (err instanceof ExitSignal) throw err;
-  fail(err instanceof Error ? err.message : String(err));
-}
 } catch (err) {
   // The only expected escape: a command asked to finish with a status.
   // Setting exitCode rather than exiting lets node drain stdout first.