@jfrog/opencode-jfrog-plugin 0.0.3 → 0.0.4

package/README.md

@@ -1,82 +1,136 @@
 # opencode-jfrog-plugin
 
-JFrog Plugin for seamless integration to Opencode
-This plugin is intended for use by JFrog Customers also using Opencode.
+JFrog integration for [OpenCode](https://opencode.ai/). The plugin ships the official JFrog
+[Agent Skills](https://opencode.ai/docs/skills/) with the package and registers them with OpenCode at
+load time, so JFrog capabilities are available to the agent out of the box.
 
-## Prerequisites
-### General:
-- [JFrog Platform](https://jfrog.com) installed
-- [Opencode](https://opencode.ai/) installed
+## What's included
+
+The plugin bundles two canonical skills, vendored (pinned) from
+[`jfrog/jfrog-skills`](https://github.com/jfrog/jfrog-skills) and committed under `skills/`:
 
-### MCP Registry:
-- Access to the corporate JFrog Platform with the AI Catalog enabled.
-- A project with at least one allowed MCP server.
+- **`jfrog`** — interact with the JFrog Platform via the JFrog CLI, MCP server, and REST/GraphQL APIs
+  (Artifactory, Xray, builds, permissions, projects, release lifecycle, advanced security, and more).
+- **`jfrog-package-safety-and-download`** — check package safety/curation status and download packages
+  through JFrog.
 
-### Curation:
-- JFrog Enterprise+ or a Unified Security Bundle
-- Xray deployment
-- Curation configuration on the used remote repositories
+The skills ship **with the plugin** (vendored and pinned). They are **not** downloaded at runtime, so
+the plugin works offline and the skill set is reproducible for a given plugin version.
 
+The plugin is **self-contained**: everything it needs is in the published npm tarball (`dist/` + the
+vendored `skills/`). There are no runtime downloads and no dependency on `releases.jfrog.io` or any other
+external artifact host.
+
+## Prerequisites
 
-> This is a Bun module created from the [bun-module](https://github.com/zenobi-us/bun-module) template
+- A [JFrog Platform](https://jfrog.com) instance you can authenticate against.
+- [OpenCode](https://opencode.ai/) installed (verified against OpenCode **1.17.7** and newer, which
+  honors `config.skills.paths` in object form).
+- For running the skills at runtime, the following must be on your `PATH`:
+  - [`jf`](https://jfrog.com/getting-started-with-jfrog-cli/) (JFrog CLI), `jq`, and `curl`.
+  - A configured JFrog CLI server (e.g. via `jf login` / `jf config add`).
 
 ## Installation
-Add the opencode-jfrog-plugin into your opencode config.
-Preferably set the plugin globally for all their developers using the Opencode remote configuration, visit [opencode remote configuration](https://opencode.ai/docs/config/#remote) for more details.
 
-The plugin configuration looks like this:
-```
-"plugin": [
-   "@jfrog/opencode-jfrog-plugin@0.0.3"
- ],
+The plugin is published to public npm as
+[`@jfrog/opencode-jfrog-plugin`](https://www.npmjs.com/package/@jfrog/opencode-jfrog-plugin) and is
+listed on the [OpenCode ecosystem page](https://opencode.ai/docs/ecosystem). OpenCode has no plugin
+marketplace — you install by referencing the npm package in your OpenCode config.
+
+Add the plugin to your OpenCode config (`opencode.json`):
+
+```json
+{
+  "plugin": ["@jfrog/opencode-jfrog-plugin"]
+}
 ```
 
-## How this works
-Once opencode starts it runs the plugin. The plugin then:
-1. Pulls a few base skills that allow the integration from the developer opencode instance into JFrog (can be found under `~/.config/opencode/skills`)
-2. Pulls integration instructions adding LLM hints on how to integrate with JFrog (can be found under `<project-root>/.jfrog/instructions`)
-3. Appends integration instructions into the runtime opencode config
+OpenCode resolves the package from npm and loads it. To pin a specific version, use
+`"@jfrog/opencode-jfrog-plugin@<version>"`; omitting the version tracks the latest release.
+
+For an organization-wide rollout, set the plugin in OpenCode's
+[remote configuration](https://opencode.ai/docs/config/#remote) so every developer gets it
+automatically.
 
-Once the skills and instructions are set, every relevant task (package management, skills and MCP handling) is integrated into JFrog.
-Once the user tries to resolve dependencies, handle packages, install MCP servers, and pull a skill, the system will verify integration prerequisites (JFrog CLI is installed and configured and `<project-root>/.jfrog/local/package-managers.json` is available) and will perform the task using JFrog capabilities.
+## How it works
 
-While the skills run, they make sure that JFrog CLI is installed and configured, and that package managers are configured against the JFrog platform.
+The plugin is intentionally **thin**. On load it:
 
-## Usage
-Developers who get the plugin through their corporate opencode configuration, or add it manually into their device configuration will automatically get the JFrog integration up and are expected to be asked for completion of package management setup when needed.
+1. Resolves its bundled `skills/` directory (shipped inside the package).
+2. Registers that directory with OpenCode through the `config` hook by adding it to
+   `config.skills.paths`.
 
-This can be handled manually or when a task requires it.
-### Manually
-Within opencode, type `/skills` and select the `jfrog-setup-package-managers` skill to complete package management and project setup.
-### Automatically
-Within opencode, when tasks require a JFrog skill, the triggered skill will guide the user through the needed setup.
+OpenCode then discovers the skills the same way it discovers any skill — they appear via the `skill`
+tool and `/skills`, and the agent invokes them when relevant. There is no runtime download, unzip, or
+network call on load.
 
-### Integration setup artifacts
-LLM instructions are automatically created at `<project-root>/.jfrog/instructions`
-Package management mappings are created at `<project-root>/.jfrog/local/package-managers.json`
-Skills are created under `~/.config/opencode/skills`
+## Updating the bundled skills
+
+The skills are vendored at a pinned version. Updating them is a build-time step and **requires a new
+plugin release** (there are no runtime skill updates). See [VENDOR.md](./VENDOR.md) for the pin-bump
+workflow (`mise run sync-skills`).
 
 ## Troubleshooting
-The JFrog plugin pulls a minimal set of JFrog integration skills and LLM instructions that allow for the integration. It also adds the instructions file into the opencode project configuration file.
-The plugin does not log by default, but allows debug logs for troubleshooting the JFrog setup process.
-To enable opencode-jfrog-plugin debug logging, run `export JFROG_DEBUG_LOGS=true` before running opencode.
+
+The plugin does not log by default. To enable debug logging:
+
+```bash
+export JFROG_DEBUG_LOGS=true
+```
+
+Logs are written to `<project-root>/.opencode/event-log.txt`.
+
+If you see a **"bundled skills not found"** error (a toast in the TUI and/or an `ERROR` line in the log),
+the installed package is incomplete or corrupted — reinstall `@jfrog/opencode-jfrog-plugin`.
+
+## Upgrading from < 0.0.3
+
+This release changes behavior in ways that are **not** backward compatible:
+
+- **Skill catalog changed (7 → 2).** The previous Artifactory skills — `skill-install`,
+  `skill-publish`, `jfrog-cli`, `opencode-jfrog-mcp`, `jfrog-setup-package-managers`, `jfrog-curation`,
+  `jfrog-packages` — are replaced by the two canonical skills above. Invocations of the removed skill
+  names no longer exist; that functionality now folds into the `jfrog` skill.
+- **Package-manager auto-setup was removed.** Earlier versions ran `jf setup <pm>` automatically on
+  session start. That is gone; the plugin now emits an interim one-line nudge to run
+  `jf setup <pm>` yourself. Durable package-manager setup is being recovered upstream in
+  `jfrog/jfrog-skills`.
+- **Old skills are not auto-cleaned.** The plugin no longer touches `~/.config/opencode/skills`. If you
+  used a version < 0.0.3, remove the old managed skill directories yourself (e.g. `skill-install`,
+  `skill-publish`, `jfrog-cli`, `opencode-jfrog-mcp`, `jfrog-setup-package-managers`, `jfrog-curation`,
+  `jfrog-packages`) under `~/.config/opencode/skills`.
+- **No more runtime artifacts.** The plugin no longer injects an instructions file
+  (`.jfrog/instructions/...`) or writes `.jfrog/local/package-managers.json`, and it no longer
+  downloads skills at runtime.
+- **Dependencies resolve from public npm.** Internal registry references were removed; the build and CI
+  now resolve from public npm.
 
 ## Development
 
-- `mise run build` - Build the module
-- `mise run test` - Run tests
-- `mise run lint` - Lint code
-- `mise run lint:fix` - Fix linting issues
-- `mise run format` - Format code with Prettier
+Tasks are run with [mise](https://mise.jdx.dev/):
+
+- `mise run build` — build the module
+- `mise run test` — run tests (`bun test`)
+- `mise run typecheck` — type-check with `tsc --noEmit`
+- `mise run lint` — lint with ESLint
+- `mise run lint:fix` — auto-fix lint issues
+- `mise run format` — format with Prettier
+- `mise run sync-skills` — re-vendor the bundled skills (see [VENDOR.md](./VENDOR.md))
 
 ## Release
 
-See the [RELEASE.md](RELEASE.md) file for instructions on how to release a new version of the module.
+See [RELEASE.md](./RELEASE.md) for how to release a new version.
 
 ## Contributing
 
-Contributions are welcome! Please file issues or submit pull requests on the GitHub repository.
+Contributions are welcome! See [CONTRIBUTING.md](./CONTRIBUTING.md). Please file issues or open pull
+requests on the GitHub repository.
 
 ## License
 
-See the [LICENSE](LICENSE) file for details.
+See the [LICENSE](./LICENSE) file for details.
+
+## Compatibility
+
+Verified against OpenCode **1.17.7** and newer (the first version confirmed to honor
+`config.skills.paths` in object form). Older versions are not supported.

package/dist/index.js

@@ -1,224 +1,21 @@
 // @bun
 // src/index.ts
-import {
-  appendFileSync,
-  createWriteStream,
-  readFileSync,
-  existsSync,
-  mkdirSync,
-  readdirSync,
-  rmSync,
-  statSync
-} from "fs";
-import { Readable } from "stream";
-import { pipeline } from "stream/promises";
+import { appendFileSync, existsSync, mkdirSync, readdirSync, statSync } from "fs";
 import { dirname, join } from "path";
+import { fileURLToPath } from "url";
 var LOG_FILE = join(process.cwd(), ".opencode", "event-log.txt");
-var SKILLS_REGISTRY_URL = "https://releases.jfrog.io/artifactory/jfrog-skills";
-var INSTRUCTIONS_REGISTRY_URL = "https://releases.jfrog.io/artifactory/run/ai/integrations/opencode/opencode-JFROG-INTEGRATION-MANAGEMENT-[RELEASE].md";
-var SKILLS_TO_INSTALL_URL = "https://releases.jfrog.io/artifactory/run/ai/integrations/opencode/opencode-JFROG-OPENCODE_SKILLS-[RELEASE].json";
-var fetchAndSaveFile = async (url, destPath, log) => {
-  const dir = dirname(destPath);
-  log("Fetching file from " + url + " and saving to " + destPath);
+var BUNDLED_SKILLS_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "skills");
+var isNonEmptyDir = (dir) => {
   if (!existsSync(dir)) {
-    log("Creating skills directory: " + dir);
-    mkdirSync(dir, { recursive: true });
+    return false;
   }
-  const response = await fetch(url);
-  if (!response.ok || !response.body) {
-    log(`Failed to fetch file from ${url}, status: ${response.status}, No response body from ${url}, response: ${JSON.stringify(response)}`);
-    return { success: false, error: `No response body from ${url}` };
-  }
-  const writer = createWriteStream(destPath);
-  await pipeline(Readable.fromWeb(response.body), writer);
-  return { success: true, error: undefined };
-};
-var extractZip = async ($, skillZipFile, skillName, skillVersion, skillZipDir, log) => {
-  const unzipResponse = await $`unzip -o ${skillZipFile} -d ${skillZipDir}`.nothrow().quiet();
-  if (unzipResponse.exitCode !== 0) {
-    log(`Failed to extract JFrog ${skillName} skill: ${unzipResponse.stderr}`);
-    return {
-      success: false,
-      error: `Failed to extract JFrog ${skillName}-${skillVersion} skill: ${unzipResponse.stderr}`
-    };
-  }
-  log(`JFrog ${skillName}-${skillVersion} skill extracted!`);
-  await $`rm -fR ${skillZipFile}`;
-  log(`Jfrog ${skillName} skill zip file removed!`);
-  return { success: true };
-};
-var setupPackageManagers = async (client, $, directory, sessionId, log) => {
-  let jfVersion;
   try {
-    jfVersion = await $`jf --version`.nothrow().quiet();
-  } catch (e) {
-    log("jf version command threw: " + e);
-    return {
-      success: false,
-      message: "Jfrog cli is not installed, please use the jfrog-cli skill to install it"
-    };
-  }
-  if (!jfVersion || jfVersion.exitCode !== 0) {
-    log("jf version command failed");
-    return {
-      success: false,
-      message: "Jfrog cli is not installed, please use the jfrog-cli skill to install it"
-    };
-  }
-  const packageManagersFile = join(directory, ".jfrog", "local", "package-managers.json");
-  if (!existsSync(packageManagersFile)) {
-    return {
-      success: false,
-      message: "Jfrog packages are not setup, please use the jfrog-setup-package-managers skill to complete setup. type /skill and select jfrog-setup-package-managers"
-    };
-  }
-  const packageManagersConfig = JSON.parse(readFileSync(packageManagersFile, "utf8"));
-  const configuredPackageManagers = packageManagersConfig.configuredPackageManagers;
-  if (!configuredPackageManagers) {
-    return {
-      success: false,
-      message: "Jfrog packages are not setup, please use the jfrog-setup-package-managers skill to complete setup. type /skill and select jfrog-cli"
-    };
-  }
-  const results = { success: [], error: [] };
-  for (const packageManager in configuredPackageManagers) {
-    const packageManagerConfig = configuredPackageManagers[packageManager];
-    const result = await $`jf setup ${packageManager} --server-id ${packageManagerConfig.serverId} --repo ${packageManagerConfig.repository}`.nothrow().quiet();
-    if (result.exitCode !== 0) {
-      results.error.push({ packageManager, error: result.stderr });
-    } else {
-      results.success.push({ packageManager });
-    }
+    return statSync(dir).isDirectory() && readdirSync(dir).length > 0;
+  } catch {
+    return false;
   }
-  var errorMessages = "";
-  if (results.error.length > 0) {
-    errorMessages = "Failed to configure package managers:" + results.error.map((e) => e.packageManager + " - " + e.error).join(", ");
-  }
-  var successMessages = "";
-  if (results.success.length > 0) {
-    successMessages = "Package managers configured successfully:" + results.success.map((s) => s.packageManager).join(", ");
-  }
-  var success = true;
-  if (results.error.length > 0) {
-    success = false;
-  }
-  log("return message=" + errorMessages + successMessages);
-  return { success, message: errorMessages + " " + successMessages };
 };
-var pullSkills = async ($, directory, log) => {
-  const failedSkills = [];
-  const jfroginstructionExists = await $`test -f ${directory}/.jfrog/instructions/JFROG-INTEGRATION-MANAGEMENT.md`.nothrow().quiet();
-  if (jfroginstructionExists.exitCode !== 0) {
-    log("JFrog integration management instructions not found, importing them locally!");
-    const result = await fetchAndSaveFile(`${INSTRUCTIONS_REGISTRY_URL}`, `${directory}/.jfrog/instructions/JFROG-INTEGRATION-MANAGEMENT.md`, log);
-    if (!result.success) {
-      log(`Failed to import JFrog integration management instructions for Opencode: ${result.error}`);
-      failedSkills.push("JFROG-INTEGRATION-MANAGEMENT");
-    }
-    log("JFrog integration management instructions imported!");
-  }
-  const response = await fetch(SKILLS_TO_INSTALL_URL);
-  if (!response.body) {
-    log(`Failed to fetch base skills list from ${SKILLS_TO_INSTALL_URL}, No response body from ${SKILLS_TO_INSTALL_URL}`);
-    return {
-      success: false,
-      failedSkills: [
-        `ALL Skills failed to fetch, No response body from ${SKILLS_TO_INSTALL_URL}, cannot install skills`
-      ]
-    };
-  }
-  const skillsBody = await response.json();
-  if (!skillsBody.skills) {
-    log(`Failed to fetch base skills list from ${SKILLS_TO_INSTALL_URL}, No skills body from ${SKILLS_TO_INSTALL_URL}`);
-    return {
-      success: false,
-      failedSkills: [
-        `ALL Skills failed to fetch, No skills body from ${SKILLS_TO_INSTALL_URL}, cannot install skills`
-      ]
-    };
-  }
-  const skillsToPull = skillsBody.skills.map((skill) => ({
-    name: skill.name,
-    version: skill.version
-  }));
-  log(`HOME: ${process.env.HOME}`);
-  const skillsDir = join(process.env.HOME || "~", ".config", "opencode", "skills");
-  if (!existsSync(skillsDir)) {
-    mkdirSync(skillsDir, { recursive: true });
-    log(`Skills directory created: ${skillsDir}`);
-  }
-  for (const skill of skillsToPull) {
-    const keepVersion = String(skill.version).trim();
-    const skillInstallDir = join(skillsDir, skill.name, keepVersion);
-    const skillExists = existsSync(skillInstallDir) && statSync(skillInstallDir).isDirectory();
-    if (!skillExists) {
-      log(`JFrog ${skill.name}-${keepVersion} skill not found, importing them locally!`);
-      const skillName = skill.name;
-      const skillVersion = keepVersion;
-      const skillZipDir = join(skillsDir, skillName, skillVersion);
-      const skillZipFile = join(skillZipDir, `${skillName}-${skillVersion}.zip`);
-      const result = await fetchAndSaveFile(`${SKILLS_REGISTRY_URL}/${skillName}/${skillVersion}/${skillName}-${skillVersion}.zip`, `${skillZipFile}`, log);
-      if (!result.success) {
-        log("Failed to import JFrog mcp skill: " + result.error);
-        failedSkills.push(skillName);
-      } else {
-        const unzipResult = await extractZip($, skillZipFile, skillName, skillVersion, skillZipDir, log);
-        if (!unzipResult.success) {
-          log(`Failed to extract ${skillName} skill: ${unzipResult.error}`);
-          failedSkills.push(skillName);
-        } else {
-          log(`${skillName} skill handling completed!`);
-          pruneNonManifestSkillVersions(skillsDir, skillName, keepVersion, log);
-        }
-      }
-    } else {
-      log(`JFrog ${skill.name}-${keepVersion} skill already present.`);
-    }
-  }
-  if (failedSkills.length > 0) {
-    return { success: false, failedSkills };
-  } else {
-    return { success: true };
-  }
-};
-var pruneNonManifestSkillVersions = (skillsDir, skillName, keepVersion, log) => {
-  const skillRoot = join(skillsDir, skillName);
-  if (!existsSync(skillRoot)) {
-    log(`No local version dirs for ${skillName} under ${skillRoot}`);
-    return;
-  }
-  let entries;
-  try {
-    entries = readdirSync(skillRoot);
-  } catch (e) {
-    log(`Could not list versions under ${skillRoot}: ${e}`);
-    return;
-  }
-  log(`Found version dirs for ${skillName}: ${entries.join(", ")} (latest version: ${keepVersion})`);
-  for (const olderVersion of entries) {
-    const versionPath = join(skillRoot, olderVersion);
-    let isDir = false;
-    try {
-      isDir = statSync(versionPath).isDirectory();
-    } catch {
-      continue;
-    }
-    if (!isDir) {
-      continue;
-    }
-    if (olderVersion === keepVersion) {
-      continue;
-    }
-    log(`Removing non-manifest version ${olderVersion} of ${skillName} (manifest: ${keepVersion})...`);
-    try {
-      rmSync(versionPath, { recursive: true, force: true });
-      log(`Removed ${skillName}/${olderVersion}`);
-    } catch (e) {
-      log(`Failed to remove ${skillName}/${olderVersion}: ${e}`);
-    }
-  }
-};
-var jfrogOpencodePlugin = async ({ client, $, directory }) => {
+var jfrogOpencodePlugin = async ({ client }) => {
   const logDir = dirname(LOG_FILE);
   if (!existsSync(logDir)) {
     mkdirSync(logDir, { recursive: true });
@@ -229,38 +26,31 @@ var jfrogOpencodePlugin = async ({ client, $, directory }) => {
 `, "utf-8");
     }
   };
+  const toast = (message, variant) => {
+    client.tui.showToast({ body: { message, variant, duration: 1e4 } }).catch(() => {
+      return;
+    });
+  };
   log("JfrogOpencodePlugin starting...");
-  const pullSkillsResponse = await pullSkills($, directory, log);
-  log("pullSkillsResponse=" + JSON.stringify(pullSkillsResponse));
+  let nudgeShown = false;
   return {
     config: async (config) => {
-      config.instructions = config.instructions || [];
-      if (config.instructions.indexOf(".jfrog/instructions/JFROG-INTEGRATION-MANAGEMENT.md") === -1) {
-        config.instructions.push(".jfrog/instructions/JFROG-INTEGRATION-MANAGEMENT.md");
-        log("jfrog integration management added to config");
+      const cfg = config;
+      cfg.skills = cfg.skills ?? {};
+      cfg.skills.paths = cfg.skills.paths ?? [];
+      if (!isNonEmptyDir(BUNDLED_SKILLS_DIR)) {
+        const message = `JFrog: bundled skills not found at ${BUNDLED_SKILLS_DIR}. ` + "The plugin package may be broken; reinstall @jfrog/opencode-jfrog-plugin.";
+        log("ERROR " + message);
+        toast(message, "error");
+        return;
+      }
+      if (!cfg.skills.paths.includes(BUNDLED_SKILLS_DIR)) {
+        cfg.skills.paths.push(BUNDLED_SKILLS_DIR);
       }
-    },
-    event: async ({ event }) => {
-      if (event.type === "session.created") {
-        const sessionId = event.properties.info.id;
-        const responses = [];
-        var pkgMngrResponse;
-        pkgMngrResponse = await setupPackageManagers(client, $, directory, sessionId, log);
-        if (pkgMngrResponse) {
-          responses.push(pkgMngrResponse);
-        }
-        log("pkgMngrResponse=" + pkgMngrResponse?.message);
-        if (responses.filter((s) => !s.success).length > 0) {
-          await client.tui.showToast({
-            body: {
-              message: responses.filter((s) => !s.success).map((s) => s.message).join(`
-
-`),
-              variant: "error",
-              duration: 1e4
-            }
-          });
-        }
+      log("config.skills.paths=" + JSON.stringify(cfg.skills.paths));
+      if (!nudgeShown) {
+        nudgeShown = true;
+        toast("JFrog: run `jf setup <pm>` to configure package managers against Artifactory.", "info");
       }
     }
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jfrog/opencode-jfrog-plugin",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "description": "JFrog Plugin for seamless integration to Opencode",
   "author": {
     "name": "JFrog",
@@ -18,7 +18,8 @@
     "jfrog",
     "artifactory",
     "opencode",
-    "plugin"
+    "plugin",
+    "skills"
   ],
   "repository": {
     "type": "git",
@@ -30,12 +31,14 @@
   },
   "files": [
     "dist",
-    "src/version.ts"
+    "skills",
+    "sync-skills-vendor.json"
   ],
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "devDependencies": {
     "@eslint/js": "^9.39.1",
+    "@opencode-ai/plugin": "^1.4.6",
     "@types/node": "^20.11.5",
     "@typescript-eslint/eslint-plugin": "8.47.0",
     "@typescript-eslint/parser": "8.47.0",
@@ -46,8 +49,5 @@
     "prettier": "^3.2.4",
     "typescript-eslint": "^8.47.0",
     "vitest": "^3.2.4"
-  },
-  "dependencies": {
-    "@opencode-ai/plugin": "^1.4.6"
   }
 }