@clinebot/core 0.0.28 → 0.0.29

package/src/auth/oca.ts

@@ -7,6 +7,7 @@ import {
 	captureAuthSucceeded,
 	identifyAccount,
 } from "../telemetry/core-events";
+import { BoundedTtlCache } from "./bounded-ttl-cache";
 import { startLocalOAuthServer } from "./server";
 import type {
 	OAuthCredentials,
@@ -113,7 +114,14 @@ const OCA_CONFIG_DEFAULTS: OcaOAuthConfig = {
 };
 
 const OCA_FLOW_STATE = new Map<string, OcaAuthFlowState>();
-const DISCOVERY_CACHE = new Map<string, string>();
+/** OpenID discovery documents change rarely; bound memory in long-lived processes. */
+const DISCOVERY_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const DISCOVERY_ERROR_FALLBACK_TTL_MS = 5 * 60 * 1000;
+const DISCOVERY_CACHE_MAX_ENTRIES = 32;
+const discoveryEndpointCache = new BoundedTtlCache(
+	DISCOVERY_CACHE_TTL_MS,
+	DISCOVERY_CACHE_MAX_ENTRIES,
+);
 
 function resolveMode(mode?: OcaMode | (() => OcaMode)): OcaMode {
 	if (typeof mode === "function") {
@@ -219,7 +227,7 @@ async function discoverTokenEndpoint(
 	requestTimeoutMs: number,
 ): Promise<string> {
 	const normalizedIdcsUrl = normalizeBaseUrl(idcsUrl);
-	const cached = DISCOVERY_CACHE.get(normalizedIdcsUrl);
+	const cached = discoveryEndpointCache.get(normalizedIdcsUrl);
 	if (cached) {
 		return cached;
 	}
@@ -232,14 +240,19 @@ async function discoverTokenEndpoint(
 
 	if (!response.ok) {
 		const fallback = `${normalizedIdcsUrl}/oauth2/v1/token`;
-		DISCOVERY_CACHE.set(normalizedIdcsUrl, fallback);
+		discoveryEndpointCache.set(
+			normalizedIdcsUrl,
+			fallback,
+			Date.now(),
+			DISCOVERY_ERROR_FALLBACK_TTL_MS,
+		);
 		return fallback;
 	}
 
 	const discovery = (await response.json()) as OcaDiscoveryDocument;
 	const endpoint =
 		discovery.token_endpoint || `${normalizedIdcsUrl}/oauth2/v1/token`;
-	DISCOVERY_CACHE.set(normalizedIdcsUrl, endpoint);
+	discoveryEndpointCache.set(normalizedIdcsUrl, endpoint);
 	return endpoint;
 }
 

package/src/{agents → extensions/config}/agent-config-loader.test.ts

@@ -1,7 +1,7 @@
 import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import type { Tool, ToolContext } from "@clinebot/agents";
+import type { Tool, ToolContext } from "@clinebot/shared";
 import { afterEach, describe, expect, it } from "vitest";
 import {
 	AGENT_CONFIG_DIRECTORY_NAME,

package/src/{agents → extensions/config}/agent-config-parser.ts

@@ -1,7 +1,7 @@
-import type { AgentConfig, Tool } from "@clinebot/agents";
+import type { AgentConfig, Tool } from "@clinebot/shared";
 import YAML from "yaml";
 import { z } from "zod";
-import { ALL_DEFAULT_TOOL_NAMES, type DefaultToolName } from "../tools";
+import { ALL_DEFAULT_TOOL_NAMES, type DefaultToolName } from "../../tools";
 
 const AgentConfigFrontmatterSchema = z.object({
 	name: z.string().trim().min(1),

package/src/{agents → extensions/config}/hooks-config-loader.ts

@@ -1,11 +1,11 @@
 import { existsSync, readdirSync } from "node:fs";
 import { basename, extname, join } from "node:path";
-import type { HookEventName } from "@clinebot/agents";
 import {
 	HOOKS_CONFIG_DIRECTORY_NAME,
 	resolveDocumentsHooksDirectoryPath,
 	resolveHooksConfigSearchPaths as resolveHooksConfigSearchPathsFromShared,
 } from "@clinebot/shared/storage";
+import type { HookEventName } from "../../hooks";
 
 export { HOOKS_CONFIG_DIRECTORY_NAME, resolveDocumentsHooksDirectoryPath };
 

package/src/{agents → extensions/config}/index.ts

@@ -30,18 +30,14 @@ export {
 	resolveHooksConfigSearchPaths,
 	toHookConfigFileName,
 } from "./hooks-config-loader";
-export type { ResolveAgentPluginPathsOptions } from "./plugin-config-loader";
-export {
-	discoverPluginModulePaths,
-	resolveAgentPluginPaths,
-	resolveAndLoadAgentPlugins,
-	resolvePluginConfigSearchPaths,
-} from "./plugin-config-loader";
-export type { LoadAgentPluginFromPathOptions } from "./plugin-loader";
+export type {
+	AvailableRuntimeCommand,
+	RuntimeCommandKind,
+} from "./runtime-commands";
 export {
-	loadAgentPluginFromPath,
-	loadAgentPluginsFromPaths,
-} from "./plugin-loader";
+	listAvailableRuntimeCommandsFromWatcher,
+	resolveRuntimeSlashCommandFromWatcher,
+} from "./runtime-commands";
 export type {
 	UnifiedConfigDefinition,
 	UnifiedConfigFileCandidate,

package/src/{runtime/commands.test.ts → extensions/config/runtime-commands.test.ts}

@@ -2,11 +2,11 @@ import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
-import { createUserInstructionConfigWatcher } from "../agents";
 import {
 	listAvailableRuntimeCommandsFromWatcher,
 	resolveRuntimeSlashCommandFromWatcher,
-} from "./commands";
+} from "./runtime-commands";
+import { createUserInstructionConfigWatcher } from "./user-instruction-config-loader";
 
 describe("runtime command registry", () => {
 	const tempRoots: string[] = [];
@@ -61,7 +61,7 @@ Run the release workflow.`,
 		}
 	});
 
-	it("expands skill and workflow slash commands with workflow precedence", async () => {
+	it("expands slash commands with workflow precedence and ignores disabled entries", async () => {
 		const tempRoot = await mkdtemp(join(tmpdir(), "core-runtime-commands-"));
 		tempRoots.push(tempRoot);
 		const skillDir = join(tempRoot, "skills", "ship");
@@ -76,6 +76,14 @@ name: ship
 ---
 Run the ship workflow.`,
 		);
+		await writeFile(
+			join(workflowsDir, "disabled.md"),
+			`---
+name: disabled
+disabled: true
+---
+Do not run this workflow.`,
+		);
 
 		const watcher = createUserInstructionConfigWatcher({
 			skills: { directories: [join(tempRoot, "skills")] },
@@ -91,6 +99,15 @@ Run the ship workflow.`,
 			expect(resolveRuntimeSlashCommandFromWatcher("/ship now", watcher)).toBe(
 				"Run the ship workflow. now",
 			);
+			expect(resolveRuntimeSlashCommandFromWatcher("/disabled", watcher)).toBe(
+				"/disabled",
+			);
+			expect(resolveRuntimeSlashCommandFromWatcher("/missing", watcher)).toBe(
+				"/missing",
+			);
+			expect(
+				resolveRuntimeSlashCommandFromWatcher("please run /ship", watcher),
+			).toBe("please run /ship");
 		} finally {
 			watcher.stop();
 		}

package/src/{runtime/commands.ts → extensions/config/runtime-commands.ts}

@@ -2,7 +2,7 @@ import type {
 	SkillConfig,
 	UserInstructionConfigWatcher,
 	WorkflowConfig,
-} from "../agents";
+} from "./user-instruction-config-loader";
 
 export type RuntimeCommandKind = "skill" | "workflow";
 
@@ -74,10 +74,3 @@ export function resolveRuntimeSlashCommandFromWatcher(
 	);
 	return matched ? `${matched.instructions}${remainder}` : input;
 }
-
-export function listAvailableRuntimeCommandsForKindFromWatcher(
-	watcher: UserInstructionConfigWatcher,
-	kind: RuntimeCommandKind,
-): AvailableRuntimeCommand[] {
-	return listCommandsForKind(watcher, kind);
-}

package/src/{agents → extensions/config}/unified-config-file-watcher.ts

@@ -84,6 +84,13 @@ function isMissingDirectoryError(error: unknown): boolean {
 	return isErrnoException(error) && error.code === "ENOENT";
 }
 
+function isInaccessibleDirectoryError(error: unknown): boolean {
+	return (
+		isErrnoException(error) &&
+		(error.code === "EACCES" || error.code === "EPERM")
+	);
+}
+
 export class UnifiedConfigFileWatcher<
 	TType extends string = string,
 	TItem = unknown,
@@ -289,7 +296,10 @@ export class UnifiedConfigFileWatcher<
 					}
 				});
 			} catch (error) {
-				if (!isMissingDirectoryError(error)) {
+				if (
+					!isMissingDirectoryError(error) &&
+					!isInaccessibleDirectoryError(error)
+				) {
 					const types = desiredTypesByDirectory.get(directoryPath);
 					if (!types) {
 						continue;
@@ -474,7 +484,10 @@ export class UnifiedConfigFileWatcher<
 				}))
 				.sort((a, b) => a.fileName.localeCompare(b.fileName));
 		} catch (error) {
-			if (isMissingDirectoryError(error)) {
+			if (
+				isMissingDirectoryError(error) ||
+				isInaccessibleDirectoryError(error)
+			) {
 				return [];
 			}
 			throw error;

package/src/{agents → extensions/config}/user-instruction-config-loader.test.ts

@@ -3,7 +3,10 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
 import {
+	createRulesConfigDefinition,
+	createSkillsConfigDefinition,
 	createUserInstructionConfigWatcher,
+	createWorkflowsConfigDefinition,
 	parseRuleConfigFromMarkdown,
 	parseSkillConfigFromMarkdown,
 	parseWorkflowConfigFromMarkdown,
@@ -48,18 +51,34 @@ describe("user instruction config loader", () => {
 			expect.arrayContaining([
 				join(workspacePath, ".clinerules", "skills"),
 				join(workspacePath, ".cline", "skills"),
-				join(workspacePath, ".claude", "skills"),
 				join(workspacePath, ".agents", "skills"),
 			]),
 		);
 		expect(resolveRulesConfigSearchPaths(workspacePath)).toEqual(
-			expect.arrayContaining([join(workspacePath, ".clinerules")]),
+			expect.arrayContaining([
+				join(workspacePath, "AGENTS.md"),
+				join(workspacePath, ".clinerules"),
+				join(workspacePath, ".cline", "rules"),
+			]),
 		);
 		expect(resolveWorkflowsConfigSearchPaths(workspacePath)).toEqual(
 			expect.arrayContaining([join(workspacePath, ".clinerules", "workflows")]),
 		);
 	});
 
+	it("discovers managed plugin instruction roots from workspace .cline manifests", () => {
+		const workspacePath = "/repo/demo";
+		expect(
+			createSkillsConfigDefinition({ workspacePath }).directories,
+		).toContain(join(workspacePath, ".cline"));
+		expect(
+			createRulesConfigDefinition({ workspacePath }).directories,
+		).toContain(join(workspacePath, ".cline"));
+		expect(
+			createWorkflowsConfigDefinition({ workspacePath }).directories,
+		).toContain(join(workspacePath, ".cline"));
+	});
+
 	it("parses markdown frontmatter for skill, rule, and workflow configs", () => {
 		const skill = parseSkillConfigFromMarkdown(
 			`---
@@ -155,4 +174,73 @@ Escalation runbook`,
 			watcher.stop();
 		}
 	});
+
+	it("loads enterprise-style managed rules, workflows, and skills through the default workspace watcher", async () => {
+		const tempRoot = await mkdtemp(
+			join(tmpdir(), "core-user-instructions-managed-"),
+		);
+		tempRoots.push(tempRoot);
+
+		const pluginRoot = join(tempRoot, ".cline", "enterprise");
+		await mkdir(join(pluginRoot, "workflows"), { recursive: true });
+		await mkdir(join(pluginRoot, "skills", "security-review"), {
+			recursive: true,
+		});
+		await writeFile(
+			join(pluginRoot, "managed.json"),
+			JSON.stringify({ source: "enterprise", version: "1", files: [] }),
+		);
+		await writeFile(
+			join(pluginRoot, "rules.md"),
+			`---
+name: enterprise-policy
+---
+Follow enterprise policy.`,
+		);
+		await writeFile(
+			join(pluginRoot, "workflows", "triage.md"),
+			`---
+name: triage
+---
+Follow the triage workflow.`,
+		);
+		await writeFile(
+			join(pluginRoot, "skills", "security-review", "SKILL.md"),
+			`---
+name: security-review
+---
+Use the security review checklist.`,
+		);
+
+		const watcher = createUserInstructionConfigWatcher({
+			skills: { workspacePath: tempRoot },
+			rules: { workspacePath: tempRoot },
+			workflows: { workspacePath: tempRoot },
+		});
+
+		try {
+			await watcher.start();
+			const rules = watcher.getSnapshot("rule");
+			const workflows = watcher.getSnapshot("workflow");
+			const skills = watcher.getSnapshot("skill");
+
+			expect(
+				[...rules.values()].some((rule) =>
+					rule.item.instructions.includes("enterprise policy"),
+				),
+			).toBe(true);
+			expect(
+				[...workflows.values()].some((workflow) =>
+					workflow.item.instructions.includes("triage workflow"),
+				),
+			).toBe(true);
+			expect(
+				[...skills.values()].some((skill) =>
+					skill.item.instructions.includes("security review checklist"),
+				),
+			).toBe(true);
+		} finally {
+			watcher.stop();
+		}
+	});
 });

package/src/{agents → extensions/config}/user-instruction-config-loader.ts

@@ -1,4 +1,4 @@
-import { readdir, stat } from "node:fs/promises";
+import { readdir, readFile, stat } from "node:fs/promises";
 import { basename, dirname, extname, join } from "node:path";
 import {
 	RULES_CONFIG_DIRECTORY_NAME,
@@ -19,6 +19,7 @@ import {
 } from "./unified-config-file-watcher";
 
 const SKILL_FILE_NAME = "SKILL.md";
+const MANAGED_PLUGIN_MANIFEST_FILE_NAME = "managed.json";
 
 const MARKDOWN_EXTENSIONS = new Set([".md", ".markdown", ".txt"]);
 
@@ -97,10 +98,57 @@ function normalizeName(name: string): string {
 	return name.trim().toLowerCase();
 }
 
+function isIgnorableDirectoryError(error: unknown): boolean {
+	const nodeError = error as NodeJS.ErrnoException;
+	return (
+		nodeError?.code === "ENOENT" ||
+		nodeError?.code === "EACCES" ||
+		nodeError?.code === "EPERM"
+	);
+}
+
 function isMarkdownFile(fileName: string): boolean {
 	return MARKDOWN_EXTENSIONS.has(extname(fileName).toLowerCase());
 }
 
+async function discoverManagedPluginRoots(
+	clineDirectoryPath: string,
+): Promise<string[]> {
+	try {
+		const entries = await readdir(clineDirectoryPath, { withFileTypes: true });
+		const pluginRoots: string[] = [];
+		for (const entry of entries) {
+			if (!entry.isDirectory()) {
+				continue;
+			}
+			const pluginRoot = join(clineDirectoryPath, entry.name);
+			const manifestPath = join(pluginRoot, MANAGED_PLUGIN_MANIFEST_FILE_NAME);
+			try {
+				const content = await readFile(manifestPath, "utf8");
+				const parsed = JSON.parse(content) as unknown;
+				if (parsed && typeof parsed === "object") {
+					pluginRoots.push(pluginRoot);
+				}
+			} catch (error) {
+				if (isIgnorableDirectoryError(error)) {
+					continue;
+				}
+				const nodeError = error as NodeJS.ErrnoException;
+				if (nodeError?.name === "SyntaxError") {
+					continue;
+				}
+				throw error;
+			}
+		}
+		return pluginRoots.sort((a, b) => a.localeCompare(b));
+	} catch (error) {
+		if (isIgnorableDirectoryError(error)) {
+			return [];
+		}
+		throw error;
+	}
+}
+
 function parseMarkdownFrontmatter(
 	content: string,
 ): ParseMarkdownFrontmatterResult {
@@ -267,6 +315,16 @@ export function resolveWorkflowsConfigSearchPaths(
 async function discoverSkillFiles(
 	directoryPath: string,
 ): Promise<ReadonlyArray<UnifiedConfigFileCandidate>> {
+	if (basename(directoryPath) === ".cline") {
+		const pluginRoots = await discoverManagedPluginRoots(directoryPath);
+		const nestedCandidates = await Promise.all(
+			pluginRoots.map((pluginRoot) =>
+				discoverSkillFiles(join(pluginRoot, SKILLS_CONFIG_DIRECTORY_NAME)),
+			),
+		);
+		return nestedCandidates.flat();
+	}
+
 	try {
 		const entries = await readdir(directoryPath, { withFileTypes: true });
 		const candidates: UnifiedConfigFileCandidate[] = [];
@@ -289,8 +347,7 @@ async function discoverSkillFiles(
 		}
 		return candidates;
 	} catch (error) {
-		const nodeError = error as NodeJS.ErrnoException;
-		if (nodeError.code === "ENOENT") {
+		if (isIgnorableDirectoryError(error)) {
 			return [];
 		}
 		throw error;
@@ -300,6 +357,16 @@ async function discoverSkillFiles(
 async function discoverRulesLikeFiles(
 	directoryPath: string,
 ): Promise<ReadonlyArray<UnifiedConfigFileCandidate>> {
+	if (basename(directoryPath) === ".cline") {
+		const pluginRoots = await discoverManagedPluginRoots(directoryPath);
+		const nestedCandidates = await Promise.all(
+			pluginRoots.map((pluginRoot) =>
+				discoverRulesLikeFiles(join(pluginRoot, "rules.md")),
+			),
+		);
+		return nestedCandidates.flat();
+	}
+
 	try {
 		const entryStat = await stat(directoryPath);
 		if (entryStat.isFile()) {
@@ -312,40 +379,81 @@ async function discoverRulesLikeFiles(
 			];
 		}
 	} catch (error) {
-		const nodeError = error as NodeJS.ErrnoException;
-		if (nodeError.code !== "ENOENT") {
+		if (!isIgnorableDirectoryError(error)) {
 			throw error;
 		}
 	}
 
 	try {
 		const entries = await readdir(directoryPath, { withFileTypes: true });
-		return entries
+		const candidates = entries
 			.filter((entry) => entry.isFile() && isMarkdownFile(entry.name))
 			.map((entry) => ({
 				directoryPath,
 				fileName: entry.name,
 				filePath: join(directoryPath, entry.name),
 			}));
+
+		// Special case: if this is a workspace root directory, also check for AGENTS.md
+		const agentsPath = join(directoryPath, "AGENTS.md");
+		try {
+			const agentsStat = await stat(agentsPath);
+			if (agentsStat.isFile()) {
+				// Check if AGENTS.md is not already in the candidates
+				const alreadyIncluded = candidates.some(
+					(c) => c.fileName === "AGENTS.md",
+				);
+				if (!alreadyIncluded) {
+					candidates.push({
+						directoryPath,
+						fileName: "AGENTS.md",
+						filePath: agentsPath,
+					});
+				}
+			}
+		} catch {
+			// AGENTS.md doesn't exist or is not accessible, which is fine
+		}
+
+		return candidates;
 	} catch (error) {
-		const nodeError = error as NodeJS.ErrnoException;
-		if (nodeError.code === "ENOENT") {
+		if (isIgnorableDirectoryError(error)) {
 			return [];
 		}
 		throw error;
 	}
 }
 
+async function discoverManagedWorkflowFiles(
+	directoryPath: string,
+): Promise<ReadonlyArray<UnifiedConfigFileCandidate>> {
+	if (basename(directoryPath) === ".cline") {
+		const pluginRoots = await discoverManagedPluginRoots(directoryPath);
+		const nestedCandidates = await Promise.all(
+			pluginRoots.map((pluginRoot) =>
+				discoverRulesLikeFiles(
+					join(pluginRoot, WORKFLOWS_CONFIG_DIRECTORY_NAME),
+				),
+			),
+		);
+		return nestedCandidates.flat();
+	}
+	return discoverRulesLikeFiles(directoryPath);
+}
+
 export function createSkillsConfigDefinition(
 	options?: CreateSkillsConfigDefinitionOptions,
 ): UnifiedConfigDefinition<"skill", SkillConfig> {
 	const directories =
 		options?.directories ??
 		resolveSkillsConfigSearchPaths(options?.workspacePath);
+	const managedRoot = options?.workspacePath
+		? join(options.workspacePath, ".cline")
+		: undefined;
 
 	return {
 		type: "skill",
-		directories,
+		directories: managedRoot ? [...directories, managedRoot] : directories,
 		discoverFiles: discoverSkillFiles,
 		includeFile: (fileName) => fileName === SKILL_FILE_NAME,
 		parseFile: (context) =>
@@ -363,10 +471,13 @@ export function createRulesConfigDefinition(
 	const directories =
 		options?.directories ??
 		resolveRulesConfigSearchPaths(options?.workspacePath);
+	const managedRoot = options?.workspacePath
+		? join(options.workspacePath, ".cline")
+		: undefined;
 
 	return {
 		type: "rule",
-		directories,
+		directories: managedRoot ? [...directories, managedRoot] : directories,
 		discoverFiles: discoverRulesLikeFiles,
 		includeFile: (fileName, filePath) =>
 			fileName === ".clinerules" ||
@@ -387,11 +498,14 @@ export function createWorkflowsConfigDefinition(
 	const directories =
 		options?.directories ??
 		resolveWorkflowsConfigSearchPaths(options?.workspacePath);
+	const managedRoot = options?.workspacePath
+		? join(options.workspacePath, ".cline")
+		: undefined;
 
 	return {
 		type: "workflow",
-		directories,
-		discoverFiles: discoverRulesLikeFiles,
+		directories: managedRoot ? [...directories, managedRoot] : directories,
+		discoverFiles: discoverManagedWorkflowFiles,
 		includeFile: (fileName) => isMarkdownFile(fileName),
 		parseFile: (context) =>
 			parseWorkflowConfigFromMarkdown(