@hoardodile/create-plugin 0.1.0 → 0.1.2

package/dist/template/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,57 @@
+name: Bug report
+description: File a bug report against this hoardodile plugin
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out this bug report.
+        Minimal reproduction steps first — the title can stay generic until the steps are clear.
+  - type: input
+    id: hoardodile-version
+    attributes:
+      label: hoardodile version
+      description: The version shown in Settings → About.
+      placeholder: 0.x.x
+    validations:
+      required: true
+  - type: input
+    id: plugin-version
+    attributes:
+      label: Plugin version
+      description: The version in Settings → Plugins (vX.Y.Z), or the marketplace's latest release if installing fresh.
+      placeholder: 0.0.1
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Minimal, ordered steps — what did you do to get here?
+      placeholder: |
+        1. …
+        2. …
+        3. …
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What did you expect to happen?
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: What actually happened instead?
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / screenshots
+      description: Paste the relevant console or server logs, or attach screenshots.
+      render: shell

package/dist/template/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,28 @@
+name: Feature request
+description: Suggest an idea for this plugin
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for suggesting! Describe the problem you are solving, not just the feature.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What problem does this feature solve? What is the current pain?
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: What would you expect to happen?
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives
+      description: Workarounds or other plugins that get partway there.

package/dist/template/.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly

package/dist/template/.github/workflows/ci.yml

@@ -0,0 +1,47 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - "**.md"
+  pull_request:
+    paths-ignore:
+      - "**.md"
+
+# A superseded push cancels the stale run instead of queueing behind it.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  # One leg is enough: lint, build and test against the SDK source.
+  checks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 11
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Build
+        run: pnpm build
+
+      - name: Test
+        run: pnpm test

package/dist/template/.github/workflows/release.yml

@@ -0,0 +1,46 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 11
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install
+
+      - name: Build the plugin
+        run: pnpm build
+
+      - name: Check the tag matches the manifest version
+        run: |
+          node -e "const m = require('./manifest.json'); const tag = process.env.GITHUB_REF_NAME; const expected = 'v' + m.version; if (tag !== expected) { console.error('tag ' + tag + ' does not match manifest version ' + expected); process.exit(1) }"
+
+      - name: Package the release artifacts
+        run: pnpm exec hoardodile plugin package --skip-build
+
+      - name: Publish the GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          files=$(ls release/*)
+          if ls intro.*.md >/dev/null 2>&1; then
+            files="$files intro.*.md"
+          fi
+          gh release create "$GITHUB_REF_NAME" $files --generate-notes

package/dist/template/.nvmrc

@@ -0,0 +1 @@
+24

package/dist/template/CONTRIBUTING.md

@@ -0,0 +1,55 @@
+# Contributing to this plugin
+
+Thanks for contributing! This is a hoardodile content plugin — sections below
+cover the dev loop, quality gates, and how releases and the marketplace work.
+
+## Development setup
+
+- Node.js ≥ 24, pnpm 11.
+- Clone the repository, then:
+
+```bash
+pnpm install
+pnpm build     # dist/ (client + server bundle + manifest)
+pnpm dev       # watch-build + workbench at http://127.0.0.1:5199
+pnpm test      # Vitest unit tests against the fixture API
+```
+
+`pnpm exec hoardodile plugin run detect testdata --plugin-dir dist` runs the
+detect hook through the same sandboxed worker the server uses.
+
+## Code style
+
+- TypeScript strict (`pnpm lint` = `tsc --noEmit`); no `any` without a comment.
+- Prefer type guards and `satisfies` over `as`.
+- Keep the plugin's own logic in `src/`; `manifest.json` at the repo root is
+  the single source of truth for the plugin's identity, permissions and UI
+  preferences.
+- Add tests next to the code they cover; keep the fixture API usage minimal.
+
+## Releases
+
+Bump `version` in `manifest.json` on user-visible changes, then:
+
+```bash
+git tag v<version> && git push origin v<version>
+```
+
+The tag must match `v<manifest.version>` — `.github/workflows/release.yml`
+builds, runs `hoardodile plugin package` (`release/<id>-<version>.zip` +
+`.sha256`) and publishes the GitHub release. Your version is independent of
+the hoardodile app version.
+
+## Marketplace publishing
+
+1. Add the repository address to your registry repo's `registry.json`.
+2. Ship `intro.<locale>.md` files (see the README) so each release carries a
+   version-pinned introduction the app can show.
+
+## Issues and pull requests
+
+- Bug reports and feature requests go through the issue templates
+  (**New issue** → bug report / feature request).
+- Pull requests should stay focused: one cohesive change, a matching test,
+  and a description of the user-visible behavior.
+- Security issues are **not** filed as public issues — see `SECURITY.md`.

package/dist/template/README.md

@@ -45,8 +45,61 @@ pnpm run detect:smoke  # sandboxed detect against testdata (needs a build first)
 `hoardodile plugin run` runs hooks through the same worker sandbox the
 server uses — the exact production execution path.
 
+## Requirements
+
+- hoardodile **≥ 0.1.1** — the built-in plugin marketplace
+  (**Settings → Marketplace**) and the batched asset-download API
+  (`download([…])`) when the manifest declares `"download": true`.
+  The marketplace's Intro and Release notes tabs and release intro
+  assets are read by newer builds; older builds still list and install
+  the plugin normally.
+- `"minAppVersion"` in `manifest.json` declares the lowest hoardodile
+  release this plugin runs on. Hosts below it refuse to install or update
+  the plugin (the marketplace gates the install/update entries and zip
+  uploads are blocked with an explanation), so bump it only when the
+  plugin really needs a newer app. Omit it for plugins that support every
+  release.
+- The plugin's version is independent of the hoardodile release
+  version; bump it on user-visible changes.
+- Dev loop: Node ≥ 24, pnpm 11.
+
 ## Deploying
 
-Zip the contents of `dist/` (with `manifest.json` at the zip root) and
-upload in **Settings → Plugins**. The app validates the manifest,
-installs it, and rescans.
+Publish to the marketplace with two steps:
+
+```bash
+# 1. Add the repository address to your registry repo's registry.json:
+#    { "version": 1, "plugins": ["https://github.com/<owner>/<repo>"] }
+
+# 2. Tag the release — `.github/workflows/release.yml` builds, packages
+#    (`release/<id>-<version>.zip` + `.sha256`) and publishes the GitHub
+#    release automatically. No local `gh` CLI or token needed.
+git tag v<version> && git push origin v<version>
+```
+
+The tag must match the manifest version (`v<manifest.version>`) — the
+workflow fails otherwise. Then paste the registry repo address once in
+**Settings → Marketplace**. The app reads the registry, each plugin's
+manifest and its latest release — names, versions, permissions and
+release notes come straight from GitHub, so the list never needs editing
+again. The zip asset is `<id>-<version>.zip` (produced by
+`hoardodile plugin package`); before the first release the plugin shows
+up with a "no release" state.
+
+Local installs (zip upload in **Settings → Plugins**) still work for
+private packages.
+
+## Publishing an introduction
+
+The marketplace detail view shows a per-release **Intro** tab. Ship one
+markdown file per supported language at the repository root, named
+`intro.<locale>.md` (e.g. `intro.en.md`, `intro.zh.md`) — `release.yml`
+uploads them alongside the zip, so **each release carries its own
+introduction** and every version shows independent notes. Use the app's
+supported language codes as file names (`en`, `zh`, `ja`, `de`, `es`) —
+a region-coded name like `intro.zh-CN.md` only matches a UI language
+resolved to that exact code, so `intro.zh.md` is what Chinese users see.
+
+The app resolves the intro for the user's UI language (exact locale → base
+language → `en` → the only shipped language); the release body always shows
+in the **Release notes** tab.

package/dist/template/SECURITY.md

@@ -0,0 +1,26 @@
+# Security policy
+
+Hoardodile plugins run as **server-side code** inside the app's restricted
+plugin sandbox — treat a plugin like any third-party dependency: only publish
+or install from sources you trust. The manifest declares the capabilities the
+sandbox grants; installs require explicit user consent.
+
+## Reporting a vulnerability
+
+Please report security issues **privately** — do **not** open a public issue,
+pull request or discussion that reveals the details.
+
+1. Open the repository's **Security** tab on GitHub.
+2. Click **Report a vulnerability** to create a private advisory.
+3. Include the affected hoardodile and plugin versions, a description of the
+   vulnerability, reproduction steps and any proof of concept.
+
+Private advisories stay invisible to the public until you publish the fix; we
+coordinate the disclosure timeline with you before anything goes public.
+
+## What counts as a security issue
+
+Anything that lets a crafted resource or plugin install break out of the
+plugin sandbox, escape the plugin's vault, or read/delete data outside the
+plugin's own scope. For usage questions and non-security bugs use the issue
+templates instead.

package/dist/template/intro.en.md

@@ -0,0 +1,18 @@
+# My plugin
+
+_Replace this introduction with a real overview: what content the plugin
+detects, how it renders it, and where users see it._
+
+This introduction ships with **every GitHub release** — edit it per release so
+each version presents its own notes in the marketplace.
+
+## Features
+
+- Detects resources containing … and renders them inline.
+- Declares the following permissions: _see `manifest.json`_.
+
+## Requirements
+
+- hoardodile ≥ 0.1.1 (see the repository README for details).
+- Trust the repository before installing — plugin code runs server-side in a
+  restricted sandbox.

package/dist/template/intro.zh.md

@@ -0,0 +1,15 @@
+# 我的插件
+
+_把这段介绍替换为真实内容：插件识别什么内容、如何渲染、用户在何处看到效果。_
+
+本介绍随**每个 GitHub Release** 一同发布——请随版本更新，让每个版本在插件市场中呈现各自的介绍。
+
+## 功能
+
+- 识别包含……的资源并以内嵌方式渲染。
+- 声明的权限：_参见 `manifest.json`_。
+
+## 要求
+
+- hoardodile ≥ 0.1.1（详见仓库 README）。
+- 安装前请确认信任该仓库——插件代码在受限沙箱中作为服务端代码运行。

package/dist/template/manifest.json

@@ -3,6 +3,7 @@
 	"name": "Template",
 	"description": "Template plugin — copy this directory to start your own plugin",
 	"version": "0.0.0",
+	"minAppVersion": "0.1.1",
 	"permissions": {
 		"sourceMeta": true,
 		"searchMeta": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hoardodile/create-plugin",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "license": "MIT",
   "description": "Scaffold a hoardodile content plugin.",
   "keywords": [
@@ -37,7 +37,7 @@
   "dependencies": {
     "@clack/prompts": "^1.7.0",
     "zod": "^4.4.3",
-    "@hoardodile/sdk-types": "0.1.0"
+    "@hoardodile/sdk-types": "0.1.2"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",