@guidobuilds/forge-ai 0.7.0 → 0.8.0

package/dist/src/processor.js

@@ -1,14 +1,18 @@
 import { access, readFile } from 'node:fs/promises';
 import { constants } from 'node:fs';
+import { homedir } from 'node:os';
 import path from 'node:path';
 import { renderClaudeAgent, renderClaudeSkill } from './adapters/claude.js';
 import { renderCodexAgent, renderCodexSkill } from './adapters/codex.js';
 import { renderGrokAgent, renderGrokSkill } from './adapters/grok.js';
 import { renderOpenCodeAgent, renderOpenCodeSkill } from './adapters/opencode.js';
+import { composeBody } from './compose.js';
 import { diagnostic } from './diagnostics.js';
 import { discoverSources } from './discovery.js';
 import { lookupEntryByPath, resolveBackupPath, sha256 } from './manifest.js';
-import { resolveOutputPath } from './paths.js';
+import { getModelPreference } from './model-preferences.js';
+import { openCodeUserRoots, resolveOpenCodeUserV2Path, resolveOutputPath } from './paths.js';
+import { supportsModel } from './platform-capabilities.js';
 import { isPlatform, platforms } from './model.js';
 const namePattern = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 const platformKeys = new Set(['claude', 'opencode', 'codex', 'grok']);
@@ -55,7 +59,13 @@ export async function buildWritePlan(options) {
         for (const platform of resolvePlatforms(options.platform)) {
             for (const artifact of artifacts) {
                 const effectiveKind = artifact[platform]?.kind ?? artifact.kind;
-                files.push(renderFile(platform, effectiveKind, artifact, options, diagnostics));
+                const rendered = renderFile(platform, effectiveKind, artifact, options, diagnostics);
+                if (platform === 'opencode' && options.scope === 'user') {
+                    files.push(...await expandOpenCodeUserTargets(rendered, options.home ?? homedir(), diagnostics));
+                }
+                else {
+                    files.push(rendered);
+                }
             }
         }
         files.sort((a, b) => `${a.platform}:${a.kind}:${a.name}`.localeCompare(`${b.platform}:${b.kind}:${b.name}`));
@@ -126,10 +136,6 @@ function convertSource(source, sourceRoot) {
         diagnostics.push(diagnostic('error', 'INVALID_KIND', 'artifact kind must be one of agent, skill', { sourcePath: source.sourcePath }));
     if (!source.body.trim())
         diagnostics.push(diagnostic('error', 'EMPTY_BODY', 'artifact body is required', { sourcePath: source.sourcePath }));
-    const bodyLines = source.body.split('\n').length;
-    const bodyBudget = bodyLineBudgets[name ?? source.expectedName] ?? defaultBodyBudget;
-    if (bodyLines > bodyBudget)
-        diagnostics.push(diagnostic('info', 'BODY_OVER_BUDGET', `artifact body is ${bodyLines} lines (soft budget ${bodyBudget}); keep always-loaded harness files small`, { sourcePath: source.sourcePath }));
     if (!name || !description || !artifactKinds.has(kind) || !source.body.trim() || diagnostics.some((item) => item.severity === 'error'))
         return { diagnostics };
     return {
@@ -153,21 +159,64 @@ function productConfig(value) {
         : undefined;
 }
 function renderFile(platform, kind, artifact, options, diagnostics) {
+    const composedBody = composeBody(artifact.body, platform);
+    const bodyLines = composedBody.split('\n').length;
+    const bodyBudget = bodyLineBudgets[artifact.name] ?? defaultBodyBudget;
+    if (bodyLines > bodyBudget)
+        diagnostics.push(diagnostic('info', 'BODY_OVER_BUDGET', `${platform} ${artifact.name} body is ${bodyLines} lines (soft budget ${bodyBudget}); keep always-loaded harness files small`, { sourcePath: artifact.sourcePath, platform }));
+    let composed = { ...artifact, body: composedBody };
+    const modelOverride = options.modelPreferences && supportsModel(platform, kind) ? getModelPreference(options.modelPreferences, platform, artifact.name) : undefined;
+    if (modelOverride)
+        composed = { ...composed, [platform]: { ...composed[platform], model: modelOverride } };
     const rendered = kind === 'agent'
-        ? platform === 'opencode' ? renderOpenCodeAgent(artifact) : platform === 'claude' ? renderClaudeAgent(artifact) : platform === 'grok' ? renderGrokAgent(artifact) : renderCodexAgent(artifact)
-        : platform === 'opencode' ? renderOpenCodeSkill(artifact) : platform === 'claude' ? renderClaudeSkill(artifact) : platform === 'grok' ? renderGrokSkill(artifact) : renderCodexSkill(artifact);
+        ? platform === 'opencode' ? renderOpenCodeAgent(composed) : platform === 'claude' ? renderClaudeAgent(composed) : platform === 'grok' ? renderGrokAgent(composed) : renderCodexAgent(composed)
+        : platform === 'opencode' ? renderOpenCodeSkill(composed) : platform === 'claude' ? renderClaudeSkill(composed) : platform === 'grok' ? renderGrokSkill(composed) : renderCodexSkill(composed);
     diagnostics.push(...rendered.diagnostics);
     return { platform, kind, scope: options.scope, name: artifact.name, sourcePath: artifact.sourcePath, path: resolveOutputPath(platform, kind, options.scope, artifact.name, options.cwd, options.home), content: rendered.content };
 }
+// `renderFile` above always computes OpenCode's v1 path (`~/.config/opencode/...`) for user scope
+// — that stays the default target. v1 and the v2 preview (`opencode2`) read user-scope
+// agents/skills from different directories (see src/paths.ts), and a machine can have either,
+// both, or — before OpenCode has ever run — neither. Writing v2's directory unconditionally would
+// silently create config for a generation that isn't actually installed; skipping v1 whenever v2
+// is present would regress the long-supported default. So: write to each generation's directory
+// only if it already exists on disk, and if neither does, keep today's behavior (write v1) rather
+// than silently installing nothing.
+async function expandOpenCodeUserTargets(base, home, diagnostics) {
+    const roots = openCodeUserRoots(home);
+    const [v1Exists, v2Exists] = await Promise.all([pathExists(roots.v1), pathExists(roots.v2)]);
+    if (!v1Exists && !v2Exists) {
+        diagnostics.push(diagnostic('info', 'OPENCODE_USER_ROOT_NOT_FOUND', `Neither ${roots.v1} (v1) nor ${roots.v2} (v2) exists yet; installing to the v1 default. Run OpenCode at least once, then re-run \`forge-ai install\`/\`update\`, to also cover whichever generation you actually use.`, { platform: 'opencode', sourcePath: base.sourcePath }));
+        return [base];
+    }
+    const files = [];
+    if (v1Exists)
+        files.push(base);
+    if (v2Exists)
+        files.push({ ...base, path: resolveOpenCodeUserV2Path(base.kind, base.name, home) });
+    return files;
+}
+async function pathExists(target) {
+    try {
+        await access(target, constants.F_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 async function classifyDestinations(files, manifest, backupRoot, anchor, pending) {
     const diagnostics = [];
     for (const file of files) {
-        const status = await classifyFile(file.path, manifest);
+        const { status, checksum } = await classifyFile(file.path, manifest);
         file.status = status;
-        if (status === 'managed-modified' && backupRoot) {
-            file.backupPath = resolveBackupPath(backupRoot, file.path, anchor);
-            pending.modifiedOverwrites.push(file);
-            diagnostics.push(diagnostic('warning', 'MANAGED_FILE_OVERWRITE', `Will overwrite locally edited Forge file ${file.path}; backup → ${file.backupPath}`, { platform: file.platform }));
+        if (status === 'managed-modified') {
+            file.expectedChecksum = checksum;
+            if (backupRoot) {
+                file.backupPath = resolveBackupPath(backupRoot, file.path, anchor);
+                pending.modifiedOverwrites.push(file);
+                diagnostics.push(diagnostic('warning', 'MANAGED_FILE_OVERWRITE', `Will overwrite locally edited Forge file ${file.path}; backup → ${file.backupPath}`, { platform: file.platform }));
+            }
         }
         else if (status === 'foreign') {
             pending.foreignOverwrites.push(file);
@@ -181,11 +230,12 @@ async function classifyFile(filePath, manifest) {
         await access(filePath, constants.F_OK);
     }
     catch {
-        return 'new';
+        return { status: 'new' };
     }
     const entry = lookupEntryByPath(manifest, filePath);
     if (!entry)
-        return 'foreign';
+        return { status: 'foreign' };
     const content = await readFile(filePath, 'utf8');
-    return sha256(content) === entry.checksum ? 'managed-unmodified' : 'managed-modified';
+    const checksum = sha256(content);
+    return checksum === entry.checksum ? { status: 'managed-unmodified' } : { status: 'managed-modified', checksum };
 }

package/dist/src/self-update.js

@@ -1,6 +1,31 @@
 import { realpathSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { resolveExecutable } from './executable-resolution.js';
 const PACKAGE = '@guidobuilds/forge-ai';
+const TRUSTED_COMMANDS = new Set(['pnpm', 'npm', 'forge-ai']);
+// --to allowlist: the literal 'latest' or a semver X.Y.Z (optional -prerelease / +build), optionally
+// 'v'-prefixed. Rejects ranges (^1.0.0, ~1.0.0), git URLs, and any other dist-tag, so no arbitrary
+// spec ever reaches `npm/pnpm install -g`.
+export function isValidVersionSpec(value) {
+    return value === 'latest' || /^v?\d+\.\d+\.\d+([-+].*)?$/.test(value);
+}
+// 'v0.4.0' -> '0.4.0'; leaves 'latest' and bare semvers untouched.
+export function normalizeVersionSpec(value) {
+    return value.replace(/^v(?=\d)/, '');
+}
+function resolveAndValidate(command, resolver, log) {
+    const resolved = resolver(command);
+    if (!resolved) {
+        log(`Could not resolve a trusted ${command} binary; refusing to run.`);
+        return { ok: false };
+    }
+    if (!TRUSTED_COMMANDS.has(path.basename(resolved))) {
+        log(`Refusing to run ${resolved}: unexpected binary name (expected ${[...TRUSTED_COMMANDS].join(', ')}).`);
+        return { ok: false };
+    }
+    return { ok: true, resolved };
+}
 export function detectInstallMethod(realPath) {
     if (/[/\\]\.npm[/\\]_npx[/\\]/.test(realPath))
         return 'npx';
@@ -31,6 +56,7 @@ export async function runSelfUpdate(options) {
     const log = options.log ?? ((message) => console.log(message));
     const resolver = options.realPathResolver ?? ((p) => realpathSync(p));
     const spawner = options.spawner ?? defaultSpawner;
+    const resolveCommand = options.resolveCommand ?? ((command) => resolveExecutable(command, { cwd: process.cwd() }));
     let realPath;
     try {
         realPath = resolver(options.binaryPath);
@@ -42,7 +68,12 @@ export async function runSelfUpdate(options) {
     // fall back to the resolved real path (catches standard global installs whose bin dir is generic).
     const symlinkMethod = detectInstallMethod(options.binaryPath);
     const method = symlinkMethod !== 'unknown' ? symlinkMethod : detectInstallMethod(realPath);
-    const cmd = buildUpdateCommand(method, options.version ?? 'latest');
+    const version = normalizeVersionSpec(options.version ?? 'latest');
+    if (!isValidVersionSpec(version)) {
+        log(`Invalid --to ${options.version}; expected a semver or "latest".`);
+        return 1;
+    }
+    const cmd = buildUpdateCommand(method, version);
     log(`Detected install: ${cmd.description} at ${realPath}`);
     if (cmd.instructions) {
         log(cmd.instructions);
@@ -53,7 +84,16 @@ export async function runSelfUpdate(options) {
         log('(dry-run, not executing)');
         return 0;
     }
-    const updateResult = spawner(cmd.command, cmd.args);
+    const spawn = (command, args) => {
+        if (options.resolveCommand) {
+            const checked = resolveAndValidate(command, resolveCommand, log);
+            if (!checked.ok)
+                return { status: 1 };
+            return spawner(checked.resolved, args);
+        }
+        return spawner(command, args);
+    };
+    const updateResult = spawn(cmd.command, cmd.args);
     if (updateResult.status !== 0) {
         log(`CLI update failed with exit code ${updateResult.status}`);
         return updateResult.status ?? 1;
@@ -61,10 +101,16 @@ export async function runSelfUpdate(options) {
     if (options.skipSpecUpdate)
         return 0;
     log('\nApplying spec kit with the updated CLI...');
-    const specResult = spawner('forge-ai', ['update']);
+    const specResult = spawn('forge-ai', ['update']);
     return specResult.status ?? 1;
 }
+// Trust boundary: package managers are developer-facing binaries resolved to an absolute path via
+// resolveExecutable (which rejects candidates inside the current working tree) and checked against
+// the { pnpm, npm, forge-ai } basename allowlist — never a bare name that PATH/cwd could shadow.
 function defaultSpawner(command, args) {
-    const result = spawnSync(command, args, { stdio: 'inherit' });
+    const checked = resolveAndValidate(command, (c) => resolveExecutable(c, { cwd: process.cwd() }), (m) => console.error(m));
+    if (!checked.ok)
+        return { status: 1 };
+    const result = spawnSync(checked.resolved, args, { stdio: 'inherit' });
     return { status: result.status };
 }

package/dist/src/writer.js

@@ -1,27 +1,25 @@
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
-import { backupFile } from './manifest.js';
+import { backupFile, sha256 } from './manifest.js';
 export async function writeOutputs(files) {
     for (const file of files) {
-        if (file.backupPath) {
+        let existing;
+        if (file.expectedChecksum || file.backupPath) {
             try {
-                const existing = await readFile(file.path, 'utf8');
-                await backupFile(file.backupPath, existing);
+                existing = await readFile(file.path, 'utf8');
             }
             catch (error) {
                 if (error.code !== 'ENOENT')
                     throw error;
-                // Original file disappeared between classification and write; no backup needed.
             }
         }
+        if (file.expectedChecksum && existing !== undefined && sha256(existing) !== file.expectedChecksum) {
+            throw new Error(`File ${file.path} changed after classification; aborting to avoid overwriting recent edits.`);
+        }
+        if (file.backupPath && existing !== undefined) {
+            await backupFile(file.backupPath, existing);
+        }
         await mkdir(path.dirname(file.path), { recursive: true });
         await writeFile(file.path, file.content, 'utf8');
     }
 }
-export async function writePluginFiles(outDir, files) {
-    for (const file of files) {
-        const target = path.join(outDir, file.relativePath);
-        await mkdir(path.dirname(target), { recursive: true });
-        await writeFile(target, file.content, 'utf8');
-    }
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guidobuilds/forge-ai",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Forge AI framework",
   "license": "MIT",
   "type": "module",
@@ -32,6 +32,6 @@
     "build:test": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "npm run build:test && node --test dist/tests/*.test.js",
-    "pretest": "git rev-parse --git-dir >/dev/null 2>&1 && git config core.hooksPath .githooks || true"
+    "generate-fixtures": "npm run build && node scripts/generate-fixtures.mjs"
   }
 }

package/dist/src/adapters/claude-plugin.js

@@ -1,43 +0,0 @@
-import { discoverArtifacts } from '../processor.js';
-import { renderClaudeAgent, renderClaudeSkill } from './claude.js';
-// Namespaces both agent-dispatch (subagent_type) and skill-load (Skill tool) cross-references to
-// their plugin-qualified form. Agent dispatch is NAMESPACE-REQUIRED and skill load is BARE-WORKS
-// only in the absence of a same-named collision from another installed source (see f0's spike and
-// the f1 adversarial verify finding in verification.md: a pre-existing CLI-push install of
-// using-forge/forge-grill under the same bare names silently wins a same-named Skill-tool
-// resolution on the affected machine). Namespacing both categories the same way keeps one uniform
-// mechanism instead of a second special case.
-//
-// Longest-alternative-first ordering (forge-worker-leaf before forge-worker) is required so the
-// regex engine matches the full literal `forge-worker-leaf` token before it could fall through to
-// the shorter `forge-worker` alternative — this avoids double-tagging embedded occurrences. The
-// two skill-load tokens (using-forge, forge-grill) do not share a prefix with any other token in
-// the list (nor with each other), so their position in the alternation does not affect matching;
-// they are listed after the agent-dispatch tokens for readability only.
-const PLUGIN_CROSS_REFERENCE_TOKENS = /(?<!forge:)\b(forge-worker-leaf|forge-worker|forge-adversary|using-forge|forge-grill)\b/g;
-export function rewritePluginCrossReferences(body) {
-    return body.replace(PLUGIN_CROSS_REFERENCE_TOKENS, (match) => `forge:${match}`);
-}
-export async function buildClaudePluginPackage(source, version, license) {
-    const { artifacts, diagnostics } = await discoverArtifacts(source);
-    const files = [];
-    for (const artifact of artifacts) {
-        const effectiveKind = artifact.claude?.kind ?? artifact.kind;
-        const rewritten = { ...artifact, body: rewritePluginCrossReferences(artifact.body) };
-        const rendered = effectiveKind === 'agent' ? renderClaudeAgent(rewritten) : renderClaudeSkill(rewritten);
-        diagnostics.push(...rendered.diagnostics);
-        const relativePath = effectiveKind === 'agent' ? `agents/${artifact.name}.md` : `skills/${artifact.name}/SKILL.md`;
-        files.push({ relativePath, content: rendered.content });
-    }
-    files.push({
-        relativePath: '.claude-plugin/plugin.json',
-        content: `${JSON.stringify({
-            name: 'forge',
-            version,
-            description: 'Forge: a thin orchestrator with delegated workers, plans, and adversarial verification.',
-            author: { name: 'Guido Caffa' },
-            license
-        }, null, 2)}\n`
-    });
-    return { files, diagnostics };
-}

package/dist/src/adapters/codex-plugin.js

@@ -1,98 +0,0 @@
-import { stringifyYaml } from '../frontmatter.js';
-import { discoverArtifacts } from '../processor.js';
-const referenceNames = new Map([
-    ['using-forge', 'using-forge'],
-    ['forge-worker', 'worker'],
-    ['forge-worker-leaf', 'worker-leaf'],
-    ['forge-adversary', 'adversary'],
-    ['forge-grill', 'grill']
-]);
-function requiredArtifact(artifacts, name, diagnostics) {
-    const artifact = artifacts.find((candidate) => candidate.name === name);
-    if (!artifact) {
-        diagnostics.push({ severity: 'error', code: 'CODEX_PLUGIN_ARTIFACT_MISSING', message: `Codex plugin requires canonical artifact ${name}`, platform: 'codex' });
-    }
-    return artifact;
-}
-export function renderCodexPluginReference(artifact) {
-    let body = artifact.body.trim();
-    if (artifact.name === 'forge-worker') {
-        body = body
-            .replace(/spawn `forge-worker-leaf` sub-agents/g, 'request root fan-out of worker-leaf sub-agents')
-            .replace(/Spawn `forge-worker-leaf`/g, 'Request root fan-out of a worker-leaf')
-            .replace(/Spawn forge-worker-leaf/g, 'Request root fan-out of worker-leaf')
-            .replace(/spawn forge-worker-leaf/g, 'request root fan-out of worker-leaf')
-            .replace('On harnesses without spawn tools (Codex), return `DELEGATION_REQUESTS` for the orchestrator to fan out `forge-worker-leaf` dispatches. Omit `DELEGATION_REQUESTS` when you self-spawn.', 'On Codex, always return `DELEGATION_REQUESTS` for the root orchestrator to fan out worker-leaf dispatches. Never self-spawn from this coordinator contract.');
-        body = `## Codex standalone subdelegation override
-
-This contract is injected into a standard/default Codex child. Never spawn a named Forge agent and never set \`agent_type\` or \`subagent_type\`. When any coordinator subdelegation trigger fires, return structured \`DELEGATION_REQUESTS\` to the root orchestrator. The root alone fans those requests out as standard/default agents after injecting the complete worker-leaf contract.
-
-${body}`;
-    }
-    if (artifact.name === 'using-forge') {
-        body = body
-            .replace(/- Never do worker work inline\./g, '- When sub-agent spawning is available, never do worker work inline; otherwise execute the route sequentially inline under the applicable role contract.')
-            .replace(/- Delegate all development and operational execution to `forge-worker`\./g, '- When sub-agent spawning is available, delegate development and operational execution to standard/default agents with the complete worker contract injected.')
-            .replace(/`forge-worker` \*\*must\*\* spawn leaves \(or return `DELEGATION_REQUESTS` on Codex\)/g, '`references/worker.md` must return `DELEGATION_REQUESTS` to the root on Codex')
-            .replace(/Codex: parse `DELEGATION_REQUESTS` and fan out `forge-worker-leaf` yourself/g, 'Codex: parse `DELEGATION_REQUESTS` and fan out standard/default agents with the complete worker-leaf contract yourself');
-    }
-    return `# ${artifact.name}\n\n${body}\n`;
-}
-export function renderCodexForgeSkill(artifact) {
-    const body = artifact.body
-        .replace('Load and follow the `using-forge` skill before routing work.', 'Read and follow `references/using-forge.md` before routing work.')
-        .replace(/`forge-worker-leaf`/g, '`references/worker-leaf.md`')
-        .replace(/`forge-worker`/g, '`references/worker.md`')
-        .replace(/`forge-adversary`/g, '`references/adversary.md`')
-        .replace(/`forge-grill`/g, '`references/grill.md`')
-        .replace(/see `using-forge`/g, 'see `references/using-forge.md`')
-        .replace('- Never do worker work inline.', '- When sub-agent spawning is available, never do worker work inline; when unavailable, execute sequentially inline using the applicable role contract.')
-        .replace('- Never do non-development execution work inline.', '- When sub-agent spawning is available, never do non-development execution work inline; when unavailable, execute it sequentially inline using the applicable role contract.')
-        .replace('- Delegate all technical and operational work to Forge workers.', '- When sub-agent spawning is available, delegate all technical and operational work to standard/default agents with injected Forge role contracts.');
-    const codexRuntime = `## Codex plugin runtime
-
-This plugin is skills-only. The files under \`references/\` are private role contracts, not discoverable custom agent types.
-
-- When delegating, call Codex's available sub-agent spawning tool with a standard/default agent. Do not set \`agent_type\`, \`subagent_type\`, or depend on a named Forge agent being installed.
-- Before spawning, read the complete applicable role contract and include it verbatim in the task: \`references/worker.md\`, \`references/worker-leaf.md\`, or \`references/adversary.md\`.
-- Child agents must not rely on plugin skill discovery. Their prompt must contain every instruction and reference needed for the bounded task.
-- If a coordinator returns \`DELEGATION_REQUESTS\`, the root agent fans those requests out as standard/default agents using the complete \`references/worker-leaf.md\` contract.
-- If no sub-agent spawning tool is available, execute the same route sequentially in the main agent, preserve approval and independent-verification boundaries as far as the runtime permits, and explicitly report that Forge is running in inline fallback mode.
-
-`;
-    return `${stringifyYaml({ name: 'forge', description: artifact.description })}${codexRuntime}${body.trim()}\n`;
-}
-export async function buildCodexPluginPackage(source, version, license) {
-    const { artifacts, diagnostics } = await discoverArtifacts(source);
-    const forge = requiredArtifact(artifacts, 'forge', diagnostics);
-    const files = [];
-    if (forge)
-        files.push({ relativePath: 'skills/forge/SKILL.md', content: renderCodexForgeSkill(forge) });
-    for (const [canonicalName, outputName] of referenceNames) {
-        const artifact = requiredArtifact(artifacts, canonicalName, diagnostics);
-        if (artifact)
-            files.push({ relativePath: `skills/forge/references/${outputName}.md`, content: renderCodexPluginReference(artifact) });
-    }
-    files.push({
-        relativePath: '.codex-plugin/plugin.json',
-        content: `${JSON.stringify({
-            name: 'forge',
-            version,
-            description: 'Forge: a thin orchestrator with delegated workers, plans, and adversarial verification.',
-            author: { name: 'Guido Caffa' },
-            license,
-            repository: 'https://github.com/guidobuilds/forge',
-            skills: './skills/',
-            interface: {
-                displayName: 'Forge',
-                shortDescription: 'Orchestrate development work with delegated verification.',
-                longDescription: 'Forge routes development work through scoped workers, approval gates, durable plans, and independent adversarial verification.',
-                developerName: 'Guido Caffa',
-                category: 'Productivity',
-                capabilities: ['Orchestration', 'Delegation', 'Verification'],
-                defaultPrompt: ['Use Forge to implement this task with the lightest safe workflow.']
-            }
-        }, null, 2)}\n`
-    });
-    return { files, diagnostics };
-}

package/dist/src/build-plugin.js

@@ -1,69 +0,0 @@
-import { access, readFile, readdir } from 'node:fs/promises';
-import { constants } from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { buildClaudePluginPackage } from './adapters/claude-plugin.js';
-import { buildCodexPluginPackage } from './adapters/codex-plugin.js';
-import { formatDiagnostic, hasErrors } from './diagnostics.js';
-import { writePluginFiles } from './writer.js';
-export async function runBuildPlugin(options) {
-    const log = options.log ?? ((message) => console.log(message));
-    const logError = options.logError ?? ((message) => console.error(message));
-    const identityPath = options.target === 'claude' ? '.claude-plugin/plugin.json' : '.codex-plugin/plugin.json';
-    if (!options.force && (await isUnsafeOutDir(options.outDir, identityPath))) {
-        logError(`Refusing to write into non-empty directory ${options.outDir} that does not look like a prior Forge ${options.target} plugin build (${identityPath} must identify plugin "forge"); re-run with --force to overwrite.`);
-        return 1;
-    }
-    const { version, license } = await readPackageMeta();
-    const { files, diagnostics } = options.target === 'claude'
-        ? await buildClaudePluginPackage(options.source, version, license)
-        : await buildCodexPluginPackage(options.source, version, license);
-    if (options.dryRun) {
-        log(`build-plugin: ${files.length} file(s) would be written to ${options.outDir}`);
-        for (const file of files)
-            log(`- ${file.relativePath}`);
-        for (const item of diagnostics)
-            log(formatDiagnostic(item));
-        return 0;
-    }
-    await writePluginFiles(options.outDir, files);
-    log(`Wrote ${files.length} file(s) to ${options.outDir}.`);
-    for (const item of diagnostics)
-        log(formatDiagnostic(item));
-    return hasErrors(diagnostics) ? 1 : 0;
-}
-async function isUnsafeOutDir(outDir, identityPath) {
-    let entries;
-    try {
-        entries = await readdir(outDir);
-    }
-    catch {
-        return false; // missing directory is safe: writePluginFiles will create it.
-    }
-    if (entries.length === 0)
-        return false; // empty directory is safe.
-    try {
-        const manifestPath = path.join(outDir, identityPath);
-        await access(manifestPath, constants.F_OK);
-        const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
-        return manifest.name !== 'forge';
-    }
-    catch {
-        return true;
-    }
-}
-async function readPackageMeta() {
-    try {
-        const packageJson = JSON.parse(await readFile(path.join(packageRoot(), 'package.json'), 'utf8'));
-        return {
-            version: typeof packageJson.version === 'string' ? packageJson.version : '0.0.0',
-            license: typeof packageJson.license === 'string' ? packageJson.license : 'UNLICENSED'
-        };
-    }
-    catch {
-        return { version: '0.0.0', license: 'UNLICENSED' };
-    }
-}
-function packageRoot() {
-    return path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-}