@aron98/load-lock 1.5.0 → 1.6.0

package/dist/shared/runtimes.js

@@ -0,0 +1,81 @@
+/**
+ * Runtime-copy bookkeeping (issue #52): which load-lock copies (package
+ * roots) have talked to this machine's daemon.
+ *
+ * The daemon records its own runtime in `daemon.json` and every copy seen
+ * via the client handshake (`clientRoot` in the request envelope) in
+ * `runtimes.json` next to it. Small entry points (skill, plugin launchers)
+ * and `doctor` read these to find an existing runtime without npx.
+ *
+ * Everything here is best-effort: unreadable/missing files yield empty
+ * lists, never a throw. A client's path hint is never trusted for the
+ * version — it is re-read from the copy's own package.json on disk.
+ */
+import { existsSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { PKG_NAME } from "./pkginfo.js";
+/** Cap on remembered copies; the least recently seen are dropped first. */
+export const MAX_RUNTIMES = 32;
+export function runtimesPath(stateDir) {
+    return join(stateDir, "runtimes.json");
+}
+/**
+ * Validate a package root: it must hold a package.json naming
+ * @aron98/load-lock with a string version. Returns the real path and the
+ * on-disk version, or null.
+ */
+export function inspectPackageRoot(root) {
+    try {
+        const real = realpathSync(root);
+        const pkg = JSON.parse(readFileSync(join(real, "package.json"), "utf8"));
+        if (pkg?.name !== PKG_NAME || typeof pkg.version !== "string")
+            return null;
+        return { path: real, version: pkg.version };
+    }
+    catch {
+        return null;
+    }
+}
+/** Known copies from the state dir, dropping entries whose path is gone. */
+export function loadRuntimes(stateDir) {
+    try {
+        const raw = JSON.parse(readFileSync(runtimesPath(stateDir), "utf8"));
+        const list = Array.isArray(raw?.copies) ? raw.copies : [];
+        return list.filter((c) => typeof c?.path === "string" &&
+            typeof c.version === "string" &&
+            typeof c.lastSeen === "number" &&
+            existsSync(join(c.path, "package.json")));
+    }
+    catch {
+        return [];
+    }
+}
+export function saveRuntimes(stateDir, copies) {
+    const path = runtimesPath(stateDir);
+    const tmp = join(stateDir, ".runtimes.json.tmp-" + process.pid);
+    writeFileSync(tmp, JSON.stringify({ copies }, null, 2) + "\n", { mode: 0o644 });
+    renameSync(tmp, path);
+}
+/**
+ * Merge one sighting into the list (dedupe by real path, newest first,
+ * capped). Returns the new list, or null when the root is not a valid
+ * load-lock copy.
+ */
+export function mergeRuntime(copies, root, now) {
+    const found = inspectPackageRoot(root);
+    if (!found)
+        return null;
+    const rest = copies.filter((c) => c.path !== found.path);
+    return [{ path: found.path, version: found.version, lastSeen: now }, ...rest]
+        .sort((a, b) => b.lastSeen - a.lastSeen)
+        .slice(0, MAX_RUNTIMES);
+}
+/** daemon.json contents, or null when missing/unreadable. */
+export function readDaemonInfo(stateDir) {
+    try {
+        return JSON.parse(readFileSync(join(stateDir, "daemon.json"), "utf8"));
+    }
+    catch {
+        return null;
+    }
+}

package/dist/shared/version.d.ts

@@ -1,3 +1,9 @@
+/**
+ * Package root of THIS copy (the directory holding its package.json):
+ * dist/shared/version.js → <package root>. Sent in the request envelope as
+ * `clientRoot` and recorded by the daemon (issue #52).
+ */
+export declare function packageRoot(): string;
 /** Version of THIS copy of load-lock (the on-disk install running now). */
 export declare function packageVersion(): string;
 /**

package/dist/shared/version.js

@@ -13,6 +13,14 @@ import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 let cached;
+/**
+ * Package root of THIS copy (the directory holding its package.json):
+ * dist/shared/version.js → <package root>. Sent in the request envelope as
+ * `clientRoot` and recorded by the daemon (issue #52).
+ */
+export function packageRoot() {
+    return join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+}
 /** Version of THIS copy of load-lock (the on-disk install running now). */
 export function packageVersion() {
     if (cached === undefined) {
@@ -20,7 +28,7 @@ export function packageVersion() {
             // dist/shared/version.js → <package root>/package.json — resolves the
             // same way in the repo checkout, a global CLI install, and an
             // opencode cache copy. npm always ships package.json with the tarball.
-            const pkgPath = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
+            const pkgPath = join(packageRoot(), "package.json");
             cached = String(JSON.parse(readFileSync(pkgPath, "utf8")).version ?? "0.0.0");
         }
         catch {

package/dist/test/ace-mcp.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/ace-mcp.test.js

@@ -0,0 +1,157 @@
+/**
+ * Contract test for the ACE MCP artifact (issue #65): `ace/mcp/mcp.json`
+ * must validate against ACE's manifest schema, as found in the #64 spike,
+ * and the folder must pass ACE's file-level rules. Light: files only, no
+ * daemon. (`load-lock mcp` itself is exercised in mcp.test.ts.)
+ *
+ * Source of truth, copied verbatim below:
+ * https://github.com/TNG/ace/blob/b703410218833071800cc918cb95718e0404640a/backend/app/domain/kinds/mcp_manifest.schema.json
+ * Rules from the same revision: backend/app/domain/kinds/MCP.md (inline
+ * secrets), compliance_mcp_rule_checks_service.py (`_first_non_flag`,
+ * companion-file roots), artifact_import_zip_safety_service.py (forbidden
+ * names in a non-plugin bundle).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, readdirSync } from "node:fs";
+import { join, dirname, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const ACE_MCP_DIR = join(REPO_ROOT, "ace", "mcp");
+const pkg = JSON.parse(readFileSync(join(REPO_ROOT, "package.json"), "utf8"));
+const ACE_MCP_SCHEMA = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    type: "object",
+    required: ["name", "transport"],
+    properties: {
+        name: { type: "string", minLength: 1 },
+        description: { type: "string" },
+        transport: { type: "string", enum: ["stdio", "http", "sse"] },
+        command: { type: "string", minLength: 1 },
+        args: { type: "array", items: { type: "string" } },
+        env: { type: "object", additionalProperties: { type: "string" } },
+        cwd: { type: "string" },
+        companion_files: { type: "array", items: { type: "string" } },
+        url: { type: "string", format: "uri", pattern: "^https://" },
+        headers: { type: "object", additionalProperties: { type: "string" } },
+    },
+    additionalProperties: false,
+    oneOf: [
+        {
+            title: "Stdio (local) MCP",
+            properties: { transport: { const: "stdio" } },
+            required: ["transport", "command"],
+            not: { anyOf: [{ required: ["url"] }, { required: ["headers"] }] },
+        },
+        {
+            title: "HTTP/SSE (remote) MCP",
+            properties: { transport: { enum: ["http", "sse"] } },
+            required: ["transport", "url"],
+            not: {
+                anyOf: [
+                    { required: ["command"] },
+                    { required: ["args"] },
+                    { required: ["env"] },
+                    { required: ["cwd"] },
+                    { required: ["companion_files"] },
+                ],
+            },
+        },
+    ],
+};
+/**
+ * Minimal JSON Schema check covering exactly the keywords the ACE schema
+ * uses (`format` is annotation-only in 2020-12). Returns error paths.
+ */
+function validate(schema, v, path = "$") {
+    const errs = [];
+    const isObj = (x) => typeof x === "object" && x !== null && !Array.isArray(x);
+    if (schema.type) {
+        const ok = schema.type === "array" ? Array.isArray(v) : schema.type === "object" ? isObj(v) : typeof v === schema.type;
+        if (!ok)
+            return [`${path}: expected ${schema.type}`];
+    }
+    if ("const" in schema && v !== schema.const)
+        errs.push(`${path}: expected ${JSON.stringify(schema.const)}`);
+    if (schema.enum && !schema.enum.includes(v))
+        errs.push(`${path}: not one of ${schema.enum.join("|")}`);
+    if (schema.minLength !== undefined && typeof v === "string" && v.length < schema.minLength)
+        errs.push(`${path}: too short`);
+    if (schema.pattern && typeof v === "string" && !new RegExp(schema.pattern, "u").test(v))
+        errs.push(`${path}: pattern`);
+    if (schema.items && Array.isArray(v))
+        v.forEach((x, i) => errs.push(...validate(schema.items, x, `${path}[${i}]`)));
+    if (isObj(v)) {
+        for (const k of schema.required ?? [])
+            if (!(k in v))
+                errs.push(`${path}: missing ${k}`);
+        for (const [k, x] of Object.entries(v)) {
+            if (schema.properties && k in schema.properties)
+                errs.push(...validate(schema.properties[k], x, `${path}.${k}`));
+            else if (schema.additionalProperties === false)
+                errs.push(`${path}.${k}: unknown field`);
+            else if (isObj(schema.additionalProperties))
+                errs.push(...validate(schema.additionalProperties, x, `${path}.${k}`));
+        }
+    }
+    if (schema.anyOf && !schema.anyOf.some((s) => validate(s, v, path).length === 0))
+        errs.push(`${path}: anyOf`);
+    if (schema.not && validate(schema.not, v, path).length === 0)
+        errs.push(`${path}: matches not`);
+    if (schema.oneOf) {
+        const n = schema.oneOf.filter((s) => validate(s, v, path).length === 0).length;
+        if (n !== 1)
+            errs.push(`${path}: matches ${n} oneOf branches`);
+    }
+    return errs;
+}
+/** ACE's `_first_non_flag`: the package the npx shim will fetch, shown to reviewers. */
+function firstNonFlag(args) {
+    return args.find((a) => !a.startsWith("-") && a !== "dlx");
+}
+const SECRET_KEY = /^(authorization|.*token|.*key|.*secret)$/i;
+const manifest = JSON.parse(readFileSync(join(ACE_MCP_DIR, "mcp.json"), "utf8"));
+test("ace mcp.json: validates against ACE's manifest schema", () => {
+    assert.deepEqual(validate(ACE_MCP_SCHEMA, manifest), []);
+});
+test("ace mcp.json: the validator rejects what ACE rejects", () => {
+    const ok = { name: "x", transport: "stdio", command: "npx" };
+    assert.deepEqual(validate(ACE_MCP_SCHEMA, ok), []);
+    assert.notDeepEqual(validate(ACE_MCP_SCHEMA, { ...ok, mode: "local" }), [], "unknown field (no `mode`)");
+    assert.notDeepEqual(validate(ACE_MCP_SCHEMA, { name: "x", transport: "stdio" }), [], "stdio without command");
+    assert.notDeepEqual(validate(ACE_MCP_SCHEMA, { ...ok, url: "https://x" }), [], "stdio with url");
+    assert.notDeepEqual(validate(ACE_MCP_SCHEMA, { ...ok, transport: "local" }), [], "bad transport");
+    assert.notDeepEqual(validate(ACE_MCP_SCHEMA, { ...ok, args: ["a", 1] }), [], "non-string arg");
+    assert.notDeepEqual(validate(ACE_MCP_SCHEMA, { ...ok, name: "" }), [], "empty name");
+});
+test("ace mcp.json: local npx server running `load-lock mcp` at the package.json pin", () => {
+    assert.equal(manifest.name, "load-lock");
+    assert.equal(manifest.transport, "stdio", "local only, never remote");
+    assert.equal(manifest.command, "npx");
+    assert.deepEqual(manifest.args, ["-y", `${pkg.name}@${pkg.version}`, "mcp"]);
+    // ACE's mcp_local_command_safe shows reviewers this as the fetched package.
+    assert.equal(firstNonFlag(manifest.args), `${pkg.name}@${pkg.version}`);
+    // npx runs the bin named after the unscoped package; it must be the CLI.
+    const unscoped = String(pkg.name).split("/").pop();
+    assert.equal(pkg.bin[unscoped], "dist/cli/main.js");
+    // `cwd` is dropped from ACE's install patch: never rely on it.
+    assert.equal(manifest.cwd, undefined);
+    for (const [k, v] of Object.entries(manifest.env ?? {})) {
+        if (SECRET_KEY.test(k))
+            assert.match(String(v), /\$\{[^}]+\}/, `env ${k} must be a \${VAR} placeholder`);
+    }
+});
+test("ace/mcp folder: only mcp.json + README, nothing ACE's bundle rules would flag", () => {
+    const files = readdirSync(ACE_MCP_DIR).sort();
+    assert.deepEqual(files, ["README.md", "mcp.json"]);
+    // companion_files roots (must match companion_files) and names forbidden in a non-plugin bundle.
+    for (const bad of ["bin", "scripts", "config", "references", ".claude-plugin", ".mcp.json", ".lsp.json", ".opencode"]) {
+        assert.ok(!files.includes(bad), bad);
+    }
+    assert.equal(manifest.companion_files, undefined);
+});
+test("ace mcp.json: pin is declared in scripts/check-pins.mjs", async () => {
+    const pins = (await import(pathToFileURL(join(REPO_ROOT, "scripts", "check-pins.mjs")).href));
+    assert.ok(pins.PINNED.some((e) => e.path === "ace/mcp/mcp.json" && e.kind === "spec"));
+    assert.deepEqual(pins.checkPins(REPO_ROOT, pkg.version), []);
+});

package/dist/test/ace-opencode.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/ace-opencode.test.js

@@ -0,0 +1,287 @@
+/**
+ * ACE detection of the `ace/opencode/` pointer folder (issue #79).
+ *
+ * Reimplements ACE's repo-sync discovery as of TNG/ace@b703410
+ * (https://github.com/TNG/ace/tree/b703410218833071800cc918cb95718e0404640a):
+ *  - backend/app/features/repo_ingestion/service/repo_ingest/
+ *    repo_ingestion_archive_discovery_service.py: `_discover`,
+ *    `_opencode_local_candidates`, `_npm_plugin_candidates`
+ *  - backend/app/domain/kinds/__init__.py: `detect_kind`,
+ *    `entry_point_filenames` (SPEC order skill, subagent, mcp, policy, plugin)
+ *  - backend/app/domain/kinds/plugin_kind.py: `ENTRY_POINT_PATH`,
+ *    `OPENCODE_LOCAL_ENTRY_POINT`, `OPENCODE_PLUGIN_DIRS`,
+ *    `opencode_local_plugin_dir`, `_resolve_package_main`,
+ *    `resolve_npm_entry_point`, `is_opencode_npm_candidate`,
+ *    `derive_npm_plugin_name`
+ * and runs it over this repo's git tree (what a GitHub zipball contains).
+ * Light: files only, no daemon.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync, readFileSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, dirname, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+const HERE = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(HERE, "..", "..");
+// plugin_kind.py
+const ENTRY_POINT_PATH = ".claude-plugin/plugin.json";
+const OPENCODE_LOCAL_ENTRY_POINT = ".opencode/plugins/plugin.ts";
+const OPENCODE_PLUGIN_DIRS = [".opencode/plugins", ".opencode/plugin"];
+const JS_ENTRY_EXTENSIONS = [".ts", ".js", ".mjs", ".cjs"];
+// kinds/__init__.py: each SPEC's entry_point_filename, in SPEC order.
+const KIND_ENTRIES = [
+    ["skill", ["SKILL.md"]],
+    ["subagent", ["AGENT.md"]],
+    ["mcp", ["mcp.json"]],
+    ["policy", ["policy.md"]],
+    ["plugin", [ENTRY_POINT_PATH, OPENCODE_LOCAL_ENTRY_POINT]],
+];
+function detectKind(names) {
+    const matched = KIND_ENTRIES.filter(([, entries]) => entries.some((e) => names.has(e))).map(([k]) => k);
+    return matched.length === 1 ? matched[0] : null;
+}
+function loadPackageJson(files) {
+    const raw = files.get("package.json");
+    if (raw === undefined)
+        return null;
+    try {
+        const m = JSON.parse(raw);
+        return m && typeof m === "object" && !Array.isArray(m) ? m : null;
+    }
+    catch {
+        return null;
+    }
+}
+const normaliseRelpath = (p) => {
+    p = p.replace(/\\/g, "/");
+    return p.startsWith("./") ? p.slice(2) : p;
+};
+function resolvePackageMain(m) {
+    const main = m.main;
+    if (typeof main === "string" && main.trim())
+        return normaliseRelpath(main);
+    const exp = m.exports;
+    let candidate = null;
+    if (typeof exp === "string")
+        candidate = exp;
+    else if (exp && typeof exp === "object") {
+        const root = exp["."];
+        if (typeof root === "string")
+            candidate = root;
+        else if (root && typeof root === "object") {
+            const r = root;
+            candidate = r.import || r.require || r.default; // Python `or` chain
+        }
+    }
+    return typeof candidate === "string" ? normaliseRelpath(candidate) : null;
+}
+function opencodeLocalPluginDir(path) {
+    const p = path.replace(/\\/g, "/");
+    if (!JS_ENTRY_EXTENSIONS.some((e) => p.endsWith(e)))
+        return null;
+    for (const pdir of OPENCODE_PLUGIN_DIRS) {
+        const seg = pdir + "/";
+        if (p.startsWith(seg)) {
+            if (!p.slice(seg.length).includes("/"))
+                return "";
+        }
+        else {
+            const marker = "/" + seg;
+            const i = p.indexOf(marker);
+            if (i !== -1 && !p.slice(i + marker.length).includes("/"))
+                return p.slice(0, i);
+        }
+    }
+    return null;
+}
+function resolveNpmEntryPoint(files) {
+    const m = loadPackageJson(files);
+    if (m === null)
+        return null;
+    const entry = resolvePackageMain(m);
+    return entry !== null && files.has(entry) ? entry : null;
+}
+function isOpencodeNpmCandidate(files, entry) {
+    if (!JS_ENTRY_EXTENSIONS.some((e) => entry.endsWith(e)))
+        return false;
+    const m = loadPackageJson(files);
+    if (m === null)
+        return false;
+    let haystack = typeof m.name === "string" ? m.name : "";
+    if (Array.isArray(m.keywords))
+        haystack += " " + m.keywords.filter((k) => typeof k === "string").join(" ");
+    return haystack.toLowerCase().includes("opencode");
+}
+function deriveNpmPluginName(files) {
+    const name = loadPackageJson(files)?.name;
+    if (typeof name !== "string" || !name.trim())
+        return null;
+    return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || null;
+}
+function npmPluginCandidates(files, claimed) {
+    const dirs = new Set();
+    for (const p of files.keys()) {
+        if (p === "package.json")
+            dirs.add("");
+        else if (p.endsWith("/package.json"))
+            dirs.add(p.slice(0, -"/package.json".length));
+    }
+    const out = new Map();
+    for (const d of dirs) {
+        if (claimed.has(d))
+            continue;
+        const prefix = d === "" ? "" : d + "/";
+        const local = new Map();
+        for (const [p, data] of files)
+            if (p === d || p.startsWith(prefix))
+                local.set(p.slice(prefix.length), data);
+        const entry = resolveNpmEntryPoint(local);
+        if (entry !== null && isOpencodeNpmCandidate(local, entry))
+            out.set(d, entry);
+    }
+    return out;
+}
+function discover(files) {
+    const entries = KIND_ENTRIES.flatMap(([, e]) => e);
+    const roots = new Map();
+    const add = (d, e) => (roots.get(d) ?? roots.set(d, new Set()).get(d)).add(e);
+    for (const p of files.keys()) {
+        for (const entry of entries) {
+            if (p === entry)
+                add("", entry);
+            else if (p.endsWith("/" + entry))
+                add(p.slice(0, -(entry.length + 1)), entry);
+        }
+    }
+    const discovered = [];
+    const skips = [];
+    for (const [d, present] of roots) {
+        const kind = detectKind(present);
+        if (kind === null) {
+            skips.push(`${d || "<root>"}: ambiguous entry-point files ${[...present].sort().join(",")}`);
+            continue;
+        }
+        let format = null;
+        if (kind === "plugin") {
+            const claude = present.has(ENTRY_POINT_PATH);
+            if (claude && present.has(OPENCODE_LOCAL_ENTRY_POINT))
+                skips.push(`${d || "<root>"}: both Claude Code and OpenCode plugin entry points present`);
+            format = claude ? "claude" : "opencode";
+        }
+        discovered.push({ subpath: d, kind, format, npmEntryPoint: null });
+    }
+    let claimed = new Set(roots.keys());
+    const claudeDirs = new Set(discovered.filter((x) => x.kind === "plugin" && x.format === "claude").map((x) => x.subpath));
+    const localDirs = new Set();
+    for (const p of files.keys()) {
+        const d = opencodeLocalPluginDir(p);
+        if (d !== null)
+            localDirs.add(d);
+    }
+    for (const d of [...localDirs].filter((x) => !claimed.has(x)).sort()) {
+        discovered.push({ subpath: d, kind: "plugin", format: "opencode", npmEntryPoint: null });
+        skips.push(`${d || "<root>"}: detected as a local OpenCode plugin (.opencode/plugins/) — verify before registering`);
+    }
+    for (const d of [...localDirs].filter((x) => claudeDirs.has(x)).sort()) {
+        skips.push(`${d || "<root>"}: both Claude Code and OpenCode plugin entry points present`);
+    }
+    claimed = new Set([...claimed, ...localDirs]);
+    for (const [d, entry] of npmPluginCandidates(files, claimed)) {
+        discovered.push({ subpath: d, kind: "plugin", format: "opencode", npmEntryPoint: entry });
+        skips.push(`${d || "<root>"}: detected as an npm-distributed OpenCode plugin via package.json heuristic — verify before registering`);
+    }
+    return { discovered, skips };
+}
+// ------------------------------------------------------------ fixtures
+/** The repo's git tree (tracked + untracked-not-ignored), as a GitHub zipball would carry it. */
+function repoTree() {
+    const r = spawnSync("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: REPO_ROOT, encoding: "utf8" });
+    if (r.status !== 0)
+        return null;
+    const files = new Map();
+    for (const p of r.stdout.split("\0")) {
+        if (!p || !existsSync(join(REPO_ROOT, p)))
+            continue; // deleted-but-staged
+        files.set(p, p.endsWith(".json") ? readFileSync(join(REPO_ROOT, p), "utf8") : "");
+    }
+    return files;
+}
+const opencodePlugins = (d) => d.filter((x) => x.kind === "plugin" && x.format === "opencode");
+// ------------------------------------------------------------ tests
+test("ace-opencode: mirror matches ACE on known shapes", () => {
+    // Root package.json whose entry is gitignored build output: not detected (#64 finding).
+    const root = discover(new Map([["package.json", JSON.stringify({ name: "@aron98/load-lock", keywords: ["opencode"], exports: { ".": { default: "./dist/x.js" } } })]]));
+    assert.deepEqual(opencodePlugins(root.discovered), []);
+    // Resolvable entry but no "opencode" naming signal: not detected.
+    const noSignal = discover(new Map([["p/package.json", JSON.stringify({ name: "x", main: "i.js" })], ["p/i.js", ""]]));
+    assert.deepEqual(opencodePlugins(noSignal.discovered), []);
+    // A folder claimed by a Claude plugin manifest is never an npm candidate.
+    const claimed = discover(new Map([
+        ["p/package.json", JSON.stringify({ name: "x-opencode", main: "i.js" })],
+        ["p/i.js", ""],
+        ["p/.claude-plugin/plugin.json", "{}"],
+    ]));
+    assert.deepEqual(opencodePlugins(claimed.discovered), []);
+    // exports "." import condition wins over require/default.
+    const exp = discover(new Map([
+        ["p/package.json", JSON.stringify({ name: "y", keywords: ["OpenCode"], exports: { ".": { import: "./a.mjs", default: "./b.js" } } })],
+        ["p/a.mjs", ""],
+    ]));
+    assert.deepEqual(opencodePlugins(exp.discovered).map((x) => [x.subpath, x.npmEntryPoint]), [["p", "a.mjs"]]);
+});
+test("ace-opencode: this repo yields exactly one OpenCode plugin, at ace/opencode", (t) => {
+    const files = repoTree();
+    if (files === null)
+        return t.skip("not a git checkout");
+    assert.ok(files.has("ace/opencode/package.json"), "ace/opencode/package.json must be tracked");
+    const { discovered, skips } = discover(files);
+    const oc = opencodePlugins(discovered);
+    assert.deepEqual(oc.map((x) => [x.subpath, x.npmEntryPoint]), [["ace/opencode", "index.js"]], JSON.stringify(discovered));
+    // Detected only via the npm heuristic, never via a flat entry point or a local .opencode/plugins/ file.
+    assert.ok(!discovered.some((x) => x.subpath === "ace/opencode" && x.npmEntryPoint === null));
+    // No ambiguity / dual-format skip for the folder; ACE's only note is the informational "verify before registering".
+    const ours = skips.filter((s) => s.startsWith("ace/opencode:"));
+    assert.equal(ours.length, 1, ours.join("\n"));
+    assert.match(ours[0], /npm-distributed OpenCode plugin .* verify before registering/);
+    assert.ok(!skips.some((s) => s.includes("ambiguous") || s.includes("both Claude Code and OpenCode")), skips.join("\n"));
+    // Artifact name ACE derives from package.json.
+    const bundle = new Map();
+    for (const [p, d] of files)
+        if (p.startsWith("ace/opencode/"))
+            bundle.set(p.slice("ace/opencode/".length), d);
+    assert.equal(deriveNpmPluginName(bundle), "load-lock-opencode");
+});
+test("ace-opencode: folder is a thin pointer to the published package, pinned to package.json", () => {
+    const dir = join(REPO_ROOT, "ace", "opencode");
+    const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+    const version = JSON.parse(readFileSync(join(REPO_ROOT, "package.json"), "utf8")).version;
+    assert.equal(pkg.private, true, "never publishable by accident");
+    assert.equal(pkg.dependencies["@aron98/load-lock"], version);
+    const code = readFileSync(join(dir, pkg.main), "utf8")
+        .split("\n")
+        .filter((l) => l.trim() && !l.trim().startsWith("//"));
+    assert.deepEqual(code, [`export { default } from "@aron98/load-lock";`]);
+});
+test("ace-opencode: pin is declared in check-pins and --write rewrites it", async () => {
+    const script = join(REPO_ROOT, "scripts", "check-pins.mjs");
+    const pins = await import(pathToFileURL(script).href);
+    const entry = pins.PINNED.find((e) => e.path === "ace/opencode/package.json");
+    assert.deepEqual(entry, { path: "ace/opencode/package.json", kind: "json", key: "dependencies.@aron98/load-lock" });
+    const root = mkdtempSync(join(tmpdir(), "ll-aceoc-"));
+    try {
+        mkdirSync(join(root, "ace", "opencode"), { recursive: true });
+        const src = readFileSync(join(REPO_ROOT, "ace", "opencode", "package.json"), "utf8");
+        writeFileSync(join(root, "ace", "opencode", "package.json"), src.replace(/"@aron98\/load-lock": "[^"]+"/, `"@aron98/load-lock": "0.0.1"`));
+        assert.equal(pins.checkPins(root, "9.9.9", [entry]).length, 1);
+        assert.deepEqual(pins.writePins(root, "9.9.9", [entry]), ["ace/opencode/package.json"]);
+        assert.deepEqual(pins.checkPins(root, "9.9.9", [entry]), []);
+        const after = JSON.parse(readFileSync(join(root, "ace", "opencode", "package.json"), "utf8"));
+        assert.equal(after.dependencies["@aron98/load-lock"], "9.9.9");
+        assert.equal(after.name, "load-lock-opencode");
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});

package/dist/test/check-pins.test.d.ts

@@ -0,0 +1 @@
+export {};