@kb-labs/cli-commands 1.0.0 → 2.1.0

package/dist/index.js

@@ -1,19 +1,20 @@
-import { safeColors, safeSymbols, getContextCwd, formatTable, toPosixPath, TimingTracker, sideBorderBox, formatCommandHelp } from '@kb-labs/shared-cli-ui';
+import { safeColors, safeSymbols, getContextCwd, toPosixPath, TimingTracker, sideBorderBox, formatCommandHelp } from '@kb-labs/shared-cli-ui';
 export { TimingTracker } from '@kb-labs/shared-cli-ui';
 import { z } from 'zod';
-import { promises, existsSync } from 'fs';
-import path2 from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
+import { promises, existsSync } from 'fs';
 import { createHash } from 'crypto';
+import path from 'path';
 import { parse } from 'yaml';
 import { glob } from 'glob';
 import { defineSystemCommand, defineSystemCommandGroup } from '@kb-labs/shared-command-kit';
-import { createCliAPI } from '@kb-labs/cli-api';
-import { PluginRegistry, getLogger, createNoOpLogger, colors, getLogLevel } from '@kb-labs/cli-core';
-import { createRequire } from 'module';
-import { validateManifest } from '@kb-labs/plugin-contracts';
+import { createRegistry, formatDiagnosticReport } from '@kb-labs/core-registry';
+import { readMarketplaceLock, DiagnosticCollector } from '@kb-labs/core-discovery';
 import { platform } from '@kb-labs/core-runtime';
+import { CredentialsManager } from '@kb-labs/cli-runtime/gateway';
 import Ajv from 'ajv';
+import { createRequire } from 'module';
+import { colors, getLogLevel } from '@kb-labs/cli-runtime';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -161,225 +162,6 @@ var init_schema = __esm({
   }
 });
 
-// src/commands/system/plugin-setup-rollback.ts
-var plugin_setup_rollback_exports = {};
-__export(plugin_setup_rollback_exports, {
-  createPluginSetupRollbackCommand: () => createPluginSetupRollbackCommand
-});
-function createPluginSetupRollbackCommand(options) {
-  const { namespace } = options;
-  return {
-    name: `${namespace}:setup:rollback`,
-    describe: `Rollback setup changes applied by ${namespace}`,
-    category: namespace,
-    examples: [
-      `kb ${namespace} setup:rollback --list`,
-      `kb ${namespace} setup:rollback --log .kb/logs/setup/${namespace}-<id>.json --yes`
-    ],
-    flags: ROLLBACK_COMMAND_FLAGS,
-    async run(ctx, _argv, rawFlags) {
-      const presenter = ctx.presenter ?? {};
-      const output = ctx.output;
-      const logger = ctx.platform?.logger;
-      const cwd = getContextCwd(ctx) ?? process.cwd();
-      logger?.info("Plugin setup rollback started", { namespace });
-      const logsDir = path2.join(cwd, ".kb", "logs", "setup");
-      const listOnly = rawFlags.list === true;
-      const autoConfirm = rawFlags.yes === true;
-      const logFlag = typeof rawFlags.log === "string" ? rawFlags.log : void 0;
-      try {
-        await promises.mkdir(logsDir, { recursive: true });
-        if (listOnly) {
-          await listLogs(logsDir, namespace, output || presenter, logger);
-          return 0;
-        }
-        const resolvedLogPath = logFlag ? resolveLogPath(logsDir, logFlag, cwd) : await findLatestLog(logsDir, namespace);
-        if (!resolvedLogPath) {
-          logger?.warn("No setup log found", { namespace, logFlag });
-          (output || presenter)?.error?.(
-            `\u041D\u0435 \u043D\u0430\u0439\u0434\u0435\u043D \u043D\u0438 \u043E\u0434\u0438\u043D \u043B\u043E\u0433 setup \u0434\u043B\u044F ${namespace}. \u0418\u0441\u043F\u043E\u043B\u044C\u0437\u0443\u0439\u0442\u0435 --log \u0434\u043B\u044F \u0443\u043A\u0430\u0437\u0430\u043D\u0438\u044F \u0444\u0430\u0439\u043B\u0430.`
-          );
-          return 1;
-        }
-        logger?.info("Using setup log", { logPath: resolvedLogPath });
-        (output || presenter)?.info?.(`~ \u0418\u0441\u043F\u043E\u043B\u044C\u0437\u0443\u0435\u043C \u043B\u043E\u0433: ${path2.relative(cwd, resolvedLogPath)}`);
-        if (!autoConfirm) {
-          (output || presenter)?.warn?.("\u0414\u043E\u0431\u0430\u0432\u044C\u0442\u0435 \u0444\u043B\u0430\u0433 --yes \u0434\u043B\u044F \u043F\u043E\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043D\u0438\u044F \u043E\u0442\u043A\u0430\u0442\u0430.");
-          return 1;
-        }
-        const entries = await readJournalEntries(resolvedLogPath);
-        if (entries.length === 0) {
-          logger?.warn("Setup log is empty", { logPath: resolvedLogPath });
-          (output || presenter)?.warn?.("\u041B\u043E\u0433 \u043F\u0443\u0441\u0442\u043E\u0439, \u043E\u0442\u043A\u0430\u0442\u044B\u0432\u0430\u0442\u044C \u043D\u0435\u0447\u0435\u0433\u043E.");
-          return 0;
-        }
-        logger?.info("Applying rollback", { entriesCount: entries.length });
-        await applyRollback(entries, cwd, output || presenter, logger);
-        logger?.info("Rollback completed");
-        (output || presenter)?.info?.("\u2713 \u041E\u0442\u043A\u0430\u0442 \u0437\u0430\u0432\u0435\u0440\u0448\u0451\u043D.");
-        return 0;
-      } catch (error) {
-        logger?.error("Rollback failed", {
-          error: error instanceof Error ? error.message : String(error)
-        });
-        (output || presenter)?.error?.(error);
-        return 1;
-      }
-    }
-  };
-}
-function resolveLogPath(logsDir, inputPath, cwd) {
-  const candidate = path2.isAbsolute(inputPath) ? inputPath : path2.resolve(cwd, inputPath);
-  if (candidate.startsWith(logsDir)) {
-    return candidate;
-  }
-  return candidate;
-}
-async function listLogs(logsDir, namespace, output, logger) {
-  const files = await safeReadDir(logsDir);
-  const filtered = files.filter((file) => file.startsWith(namespace) && file.endsWith(".json")).sort().reverse();
-  logger?.info("Listing setup logs", { namespace, count: filtered.length });
-  if (filtered.length === 0) {
-    output?.info?.("\u041B\u043E\u0433\u0438 \u043D\u0435 \u043D\u0430\u0439\u0434\u0435\u043D\u044B.");
-    return;
-  }
-  output?.info?.("\u0414\u043E\u0441\u0442\u0443\u043F\u043D\u044B\u0435 \u043B\u043E\u0433\u0438 setup:");
-  for (const file of filtered) {
-    output?.info?.(` \u2022 ${file}`);
-  }
-}
-async function safeReadDir(dir) {
-  try {
-    return await promises.readdir(dir);
-  } catch (error) {
-    if (error?.code === "ENOENT") {
-      return [];
-    }
-    throw error;
-  }
-}
-async function findLatestLog(logsDir, namespace) {
-  const entries = await safeReadDir(logsDir);
-  const candidates = await Promise.all(
-    entries.filter((file) => file.startsWith(namespace) && file.endsWith(".json")).map(async (file) => {
-      const fullPath = path2.join(logsDir, file);
-      const stat = await promises.stat(fullPath);
-      return { path: fullPath, mtime: stat.mtimeMs };
-    })
-  );
-  if (candidates.length === 0) {
-    return null;
-  }
-  candidates.sort((a, b) => b.mtime - a.mtime);
-  return candidates[0]?.path ?? null;
-}
-async function readJournalEntries(logPath) {
-  const content = await promises.readFile(logPath, "utf8");
-  const parsed = JSON.parse(content);
-  if (!Array.isArray(parsed)) {
-    throw new Error("\u041D\u0435\u0432\u0435\u0440\u043D\u044B\u0439 \u0444\u043E\u0440\u043C\u0430\u0442 \u043B\u043E\u0433\u0430 setup.");
-  }
-  return parsed;
-}
-async function applyRollback(entries, cwd, output, logger) {
-  logger?.info("Applying rollback operations", { entriesCount: entries.length });
-  for (const entry of [...entries].reverse()) {
-    const operation = entry.operation?.operation;
-    if (!operation) {
-      continue;
-    }
-    switch (operation.kind) {
-      case "file":
-      case "config":
-      case "script":
-        await restoreFileLikeOperation(entry, cwd, output, logger);
-        break;
-      default:
-        logger?.warn("Skipping operation (rollback not implemented)", { kind: operation.kind });
-        output?.warn?.(
-          `\u041F\u0440\u043E\u043F\u0443\u0441\u043A \u043E\u043F\u0435\u0440\u0430\u0446\u0438\u0438 ${operation.kind} (\u043E\u0442\u043A\u0430\u0442 \u043D\u0435 \u0440\u0435\u0430\u043B\u0438\u0437\u043E\u0432\u0430\u043D).`
-        );
-    }
-  }
-}
-async function restoreFileLikeOperation(entry, cwd, output, logger) {
-  const operation = entry.operation.operation;
-  const relativePath = operation.kind === "script" ? operation.file : operation.path;
-  const targetPath = resolveWithinWorkspace(cwd, relativePath);
-  if (entry.backupPath) {
-    await copyBackup(entry.backupPath, targetPath, output, logger);
-    return;
-  }
-  if (entry.before?.exists === false) {
-    await promises.rm(targetPath, { force: true, recursive: false });
-    logger?.info("File removed during rollback", { path: targetPath });
-    output?.info?.(`\u2212 \u0423\u0434\u0430\u043B\u0451\u043D ${path2.relative(cwd, targetPath)}`);
-    return;
-  }
-  if (typeof entry.before?.content === "string") {
-    if (entry.before.content.startsWith("<truncated")) {
-      logger?.warn("Skipping truncated file", { path: targetPath });
-      output?.warn?.(
-        `\u041F\u0440\u043E\u043F\u0443\u0441\u043A ${path2.relative(cwd, targetPath)} \u2014 \u0441\u043E\u0434\u0435\u0440\u0436\u0438\u043C\u043E\u0435 \u043B\u043E\u0433\u0430 \u0443\u0441\u0435\u0447\u0435\u043D\u043E.`
-      );
-      return;
-    }
-    await promises.mkdir(path2.dirname(targetPath), { recursive: true });
-    await promises.writeFile(targetPath, entry.before.content, "utf8");
-    logger?.info("File restored from log", { path: targetPath });
-    output?.info?.(`\u21BA \u0412\u043E\u0441\u0441\u0442\u0430\u043D\u043E\u0432\u043B\u0435\u043D ${path2.relative(cwd, targetPath)}`);
-    return;
-  }
-  logger?.warn("Skipping file (no restore data)", { path: targetPath });
-  output?.warn?.(
-    `\u041F\u0440\u043E\u043F\u0443\u0441\u043A ${path2.relative(cwd, targetPath)} \u2014 \u043E\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044E\u0442 \u0434\u0430\u043D\u043D\u044B\u0435 \u0434\u043B\u044F \u0432\u043E\u0441\u0441\u0442\u0430\u043D\u043E\u0432\u043B\u0435\u043D\u0438\u044F.`
-  );
-}
-function resolveWithinWorkspace(workspace, target) {
-  const resolvedWorkspace = path2.resolve(workspace);
-  const resolvedTarget = path2.resolve(resolvedWorkspace, target);
-  if (!resolvedTarget.startsWith(resolvedWorkspace)) {
-    throw new Error(`\u041F\u0443\u0442\u044C ${target} \u0432\u044B\u0445\u043E\u0434\u0438\u0442 \u0437\u0430 \u043F\u0440\u0435\u0434\u0435\u043B\u044B \u0440\u0430\u0431\u043E\u0447\u0435\u0439 \u0434\u0438\u0440\u0435\u043A\u0442\u043E\u0440\u0438\u0438.`);
-  }
-  return resolvedTarget;
-}
-async function copyBackup(backupPath, destination, output, logger) {
-  try {
-    await promises.access(backupPath);
-  } catch {
-    logger?.warn("Backup not found", { backupPath });
-    output?.warn?.(`\u041F\u0440\u043E\u043F\u0443\u0441\u043A \u2014 backup ${backupPath} \u043D\u0435 \u043D\u0430\u0439\u0434\u0435\u043D.`);
-    return;
-  }
-  await promises.mkdir(path2.dirname(destination), { recursive: true });
-  await promises.copyFile(backupPath, destination);
-  logger?.info("File restored from backup", { backupPath, destination });
-  output?.info?.(`\u21BA \u0412\u043E\u0441\u0441\u0442\u0430\u043D\u043E\u0432\u043B\u0435\u043D \u0438\u0437 backup ${path2.basename(destination)}`);
-}
-var ROLLBACK_COMMAND_FLAGS;
-var init_plugin_setup_rollback = __esm({
-  "src/commands/system/plugin-setup-rollback.ts"() {
-    ROLLBACK_COMMAND_FLAGS = [
-      {
-        name: "log",
-        type: "string",
-        description: "Path to a setup change log JSON file. Defaults to latest log for the namespace."
-      },
-      {
-        name: "list",
-        type: "boolean",
-        description: "List available setup change logs and exit."
-      },
-      {
-        name: "yes",
-        type: "boolean",
-        alias: "y",
-        description: "Apply rollback without confirmation prompt."
-      }
-    ];
-  }
-});
-
 // src/registry/discover.ts
 var discover_exports = {};
 __export(discover_exports, {
@@ -394,41 +176,9 @@ function createManifestV3Loader(commandId) {
     );
   };
 }
-async function loadSetupRollbackCommandModule({
-  manifestV2,
-  namespace,
-  pkgName,
-  pkgRoot
-}) {
-  const module = await Promise.resolve().then(() => (init_plugin_setup_rollback(), plugin_setup_rollback_exports));
-  if (typeof module.createPluginSetupRollbackCommand !== "function") {
-    throw new Error("Failed to load plugin setup rollback command factory");
-  }
-  const command = module.createPluginSetupRollbackCommand({
-    namespace,
-    packageName: pkgName,
-    pkgRoot
-  });
-  return {
-    run: async (ctx, argv, flags) => {
-      const result = await command.run(ctx, argv, flags);
-      return typeof result === "number" ? result : void 0;
-    }
-  };
-}
 function ensureManifestLoader(manifest) {
   if (typeof manifest.loader !== "function") {
     const commandId = manifest.id || manifest.group || "unknown";
-    if (manifest.isSetupRollback) {
-      log("debug", `[plugins][cache] Rehydrated setup rollback loader for ${commandId}`);
-      manifest.loader = () => loadSetupRollbackCommandModule({
-        manifestV2: manifest.manifestV2,
-        namespace: manifest.namespace || manifest.group || deriveNamespace(manifest.package || commandId),
-        pkgName: manifest.package || commandId,
-        pkgRoot: manifest.pkgRoot
-      });
-      return;
-    }
     log("debug", `[plugins][cache] Rehydrated loader for ${commandId}`);
     manifest.loader = createManifestV3Loader(commandId);
   }
@@ -468,7 +218,7 @@ async function computeManifestHash(manifestPath) {
   }
 }
 async function computeLockfileHash(cwd) {
-  const lockfilePath = path2.join(cwd, "pnpm-lock.yaml");
+  const lockfilePath = path.join(cwd, "pnpm-lock.yaml");
   try {
     const content = await promises.readFile(lockfilePath, "utf8");
     return createHash("sha256").update(content).digest("hex");
@@ -477,7 +227,7 @@ async function computeLockfileHash(cwd) {
   }
 }
 async function computeConfigHash(cwd) {
-  const configPath = path2.join(cwd, ".kb", "kb.config.json");
+  const configPath = path.join(cwd, ".kb", "kb.config.json");
   try {
     const content = await promises.readFile(configPath, "utf8");
     return createHash("sha256").update(content).digest("hex");
@@ -486,7 +236,7 @@ async function computeConfigHash(cwd) {
   }
 }
 async function computePluginsStateHash(cwd) {
-  const pluginsPath = path2.join(cwd, ".kb", "plugins.json");
+  const pluginsPath = path.join(cwd, ".kb", "plugins.json");
   try {
     const content = await promises.readFile(pluginsPath, "utf8");
     return createHash("sha256").update(content).digest("hex");
@@ -499,7 +249,7 @@ async function detectNewWorkspacePackages(cwd, cachedPackages) {
     return true;
   }
   try {
-    const workspaceYaml = path2.join(cwd, "pnpm-workspace.yaml");
+    const workspaceYaml = path.join(cwd, "pnpm-workspace.yaml");
     const content = await promises.readFile(workspaceYaml, "utf8");
     const parsed = parse(content);
     if (!Array.isArray(parsed.packages)) {
@@ -507,15 +257,15 @@ async function detectNewWorkspacePackages(cwd, cachedPackages) {
     }
     const knownPackages = new Set(Object.keys(cachedPackages));
     for (const pattern of parsed.packages) {
-      const pkgPattern = path2.join(pattern, PACKAGE_JSON);
+      const pkgPattern = path.join(pattern, PACKAGE_JSON);
       const pkgFiles = await glob(pkgPattern, {
         cwd,
         absolute: false,
         ignore: [".kb/**", "node_modules/**", "**/node_modules/**"]
       });
       for (const pkgFile of pkgFiles) {
-        const pkgRoot = path2.dirname(path2.join(cwd, pkgFile));
-        const pkg = await readPackageJson(path2.join(cwd, pkgFile));
+        const pkgRoot = path.dirname(path.join(cwd, pkgFile));
+        const pkg = await readPackageJson(path.join(cwd, pkgFile));
         if (!pkg || !pkg.name) {
           continue;
         }
@@ -558,11 +308,6 @@ function getNamespaceFromManifest(manifestV2, packageName) {
   const last = parts[parts.length - 1] || packageName;
   return last.replace(/^@/, "");
 }
-function deriveNamespace(packageName) {
-  const parts = packageName.split("/");
-  const lastPart = parts[parts.length - 1] || packageName;
-  return lastPart.replace(/^@/, "");
-}
 async function loadManifest(manifestPath, pkgName, pkgRoot) {
   const fileUrl = pathToFileURL(manifestPath).href;
   const mod = await import(fileUrl);
@@ -571,7 +316,7 @@ async function loadManifest(manifestPath, pkgName, pkgRoot) {
     throw new Error(`Unsupported manifest format in ${pkgName}. Only kb.plugin/3 schema is supported.`);
   }
   const namespace = getNamespaceFromManifest(manifest, pkgName);
-  const manifestDir = path2.dirname(manifestPath);
+  const manifestDir = path.dirname(manifestPath);
   const baseRoot = pkgRoot || manifestDir;
   const cliCommands = Array.isArray(manifest.cli?.commands) ? manifest.cli.commands : [];
   if (cliCommands.length === 0 && !manifest.setup) {
@@ -583,6 +328,7 @@ async function loadManifest(manifestPath, pkgName, pkgRoot) {
       manifestVersion: "1.0",
       id: commandId,
       group: cmd.group || namespace,
+      subgroup: cmd.subgroup,
       describe: cmd.describe || "",
       longDescription: cmd.longDescription,
       aliases: cmd.aliases,
@@ -616,7 +362,7 @@ async function readPackageJson(pkgPath) {
   }
 }
 async function loadConfig(cwd) {
-  const configPath = path2.join(cwd, ".kb", "kb.config.json");
+  const configPath = path.join(cwd, ".kb", "kb.config.json");
   try {
     const content = await promises.readFile(configPath, "utf8");
     const config = JSON.parse(content);
@@ -631,7 +377,7 @@ async function loadConfig(cwd) {
 }
 async function findManifestPath(pkgRoot, pkg) {
   if (pkg.kb?.manifest) {
-    const manifestPath = path2.join(pkgRoot, pkg.kb.manifest);
+    const manifestPath = path.join(pkgRoot, pkg.kb.manifest);
     try {
       await promises.access(manifestPath);
       return { path: manifestPath, deprecated: false };
@@ -643,7 +389,7 @@ async function findManifestPath(pkgRoot, pkg) {
     const exportPath = pkg.exports["./kb/commands"];
     const manifestPath = typeof exportPath === "string" ? exportPath : exportPath.default || exportPath.import;
     if (manifestPath) {
-      const resolved = path2.resolve(pkgRoot, manifestPath);
+      const resolved = path.resolve(pkgRoot, manifestPath);
       try {
         await promises.access(resolved);
         return { path: resolved, deprecated: false };
@@ -688,7 +434,7 @@ function validateUniqueIds(manifests, pkgName) {
   }
 }
 async function discoverWorkspace(cwd) {
-  const workspaceYaml = path2.join(cwd, "pnpm-workspace.yaml");
+  const workspaceYaml = path.join(cwd, "pnpm-workspace.yaml");
   const content = await promises.readFile(workspaceYaml, "utf8");
   const parsed = parse(content);
   if (!parsed.packages || !Array.isArray(parsed.packages)) {
@@ -696,7 +442,7 @@ async function discoverWorkspace(cwd) {
   }
   const packageInfos = [];
   for (const pattern of parsed.packages) {
-    const pkgPattern = path2.join(pattern, PACKAGE_JSON);
+    const pkgPattern = path.join(pattern, PACKAGE_JSON);
     const pkgFiles = await glob(pkgPattern, {
       cwd,
       absolute: false,
@@ -704,8 +450,8 @@ async function discoverWorkspace(cwd) {
       // Ignore .kb, node_modules
     });
     for (const pkgFile of pkgFiles) {
-      const pkgRoot = path2.dirname(path2.join(cwd, pkgFile));
-      const pkg = await readPackageJson(path2.join(cwd, pkgFile));
+      const pkgRoot = path.dirname(path.join(cwd, pkgFile));
+      const pkg = await readPackageJson(path.join(cwd, pkgFile));
       if (!pkg) {
         continue;
       }
@@ -770,7 +516,7 @@ async function discoverWorkspace(cwd) {
 }
 async function discoverCurrentPackage(cwd) {
   try {
-    const pkg = await readPackageJson(path2.join(cwd, PACKAGE_JSON));
+    const pkg = await readPackageJson(path.join(cwd, PACKAGE_JSON));
     if (!pkg) {
       return null;
     }
@@ -798,7 +544,7 @@ async function discoverCurrentPackage(cwd) {
   return null;
 }
 async function discoverNodeModules(cwd) {
-  const nmDir = path2.join(cwd, "node_modules");
+  const nmDir = path.join(cwd, "node_modules");
   const config = await loadConfig(cwd);
   try {
     const entries = await promises.readdir(nmDir, { withFileTypes: true });
@@ -812,12 +558,12 @@ async function discoverNodeModules(cwd) {
         let pkgRoot;
         let pkg;
         if (entry.name.startsWith("@")) {
-          const scopeDir = path2.join(nmDir, entry.name);
+          const scopeDir = path.join(nmDir, entry.name);
           try {
             const scopedDirs = await promises.readdir(scopeDir, { withFileTypes: true });
             for (const scopedEntry of scopedDirs.filter((d) => d.isDirectory())) {
-              pkgRoot = path2.join(scopeDir, scopedEntry.name);
-              pkg = await readPackageJson(path2.join(pkgRoot, PACKAGE_JSON));
+              pkgRoot = path.join(scopeDir, scopedEntry.name);
+              pkg = await readPackageJson(path.join(pkgRoot, PACKAGE_JSON));
               if (!pkg) {
                 continue;
               }
@@ -834,7 +580,7 @@ async function discoverNodeModules(cwd) {
                 }
                 const isAllowlisted = config.allow?.includes(pkg.name) || config.linked?.includes(pkg.name);
                 if (!isAllowlisted) {
-                  log("debug", `Plugin ${pkg.name} skipped (not allowlisted). Add to kb-labs.config.json plugins.allow or enable via 'kb plugins enable'`);
+                  log("debug", `Plugin ${pkg.name} skipped (not allowlisted). Add to kb-labs.config.json plugins.allow or enable via 'kb marketplace enable'`);
                   return;
                 }
                 const manifestInfo = await findManifestPath(pkgRoot, pkg);
@@ -851,8 +597,8 @@ async function discoverNodeModules(cwd) {
           } catch {
           }
         } else {
-          pkgRoot = path2.join(nmDir, entry.name);
-          pkg = await readPackageJson(path2.join(pkgRoot, PACKAGE_JSON));
+          pkgRoot = path.join(nmDir, entry.name);
+          pkg = await readPackageJson(path.join(pkgRoot, PACKAGE_JSON));
           if (!pkg) {
             return;
           }
@@ -864,7 +610,7 @@ async function discoverNodeModules(cwd) {
             }
             const isAllowlisted = config.allow?.includes(pkg.name) || config.linked?.includes(pkg.name);
             if (!isAllowlisted) {
-              log("debug", `Plugin ${pkg.name} skipped (not allowlisted). Add to kb-labs.config.json plugins.allow or enable via 'kb plugins enable'`);
+              log("debug", `Plugin ${pkg.name} skipped (not allowlisted). Add to kb-labs.config.json plugins.allow or enable via 'kb marketplace enable'`);
               return;
             }
             const manifestInfo = await findManifestPath(pkgRoot, pkg);
@@ -951,7 +697,7 @@ function deduplicateManifests(all) {
   return Array.from(byPackageName.values());
 }
 async function loadCache(cwd) {
-  const cachePath = path2.join(cwd, ".kb", "cache", "cli-manifests.json");
+  const cachePath = path.join(cwd, ".kb", "cache", "cli-manifests.json");
   try {
     const content = await promises.readFile(cachePath, "utf8");
     const cache = JSON.parse(content);
@@ -1001,8 +747,8 @@ async function loadCache(cwd) {
   }
 }
 async function isPackageCacheStale(entry, options) {
-  const manifestFsPath = entry.manifestPath.split("/").join(path2.sep);
-  const pkgJsonPath = path2.join(entry.result.pkgRoot.split("/").join(path2.sep), PACKAGE_JSON);
+  const manifestFsPath = entry.manifestPath.split("/").join(path.sep);
+  const pkgJsonPath = path.join(entry.result.pkgRoot.split("/").join(path.sep), PACKAGE_JSON);
   try {
     const pkgStat = await promises.stat(pkgJsonPath);
     if (pkgStat.mtimeMs !== entry.pkgJsonMtime) {
@@ -1039,19 +785,19 @@ async function isPackageCacheStale(entry, options) {
   return false;
 }
 async function saveCache(cwd, results) {
-  const cachePath = path2.join(cwd, ".kb", "cache", "cli-manifests.json");
-  await promises.mkdir(path2.dirname(cachePath), { recursive: true });
+  const cachePath = path.join(cwd, ".kb", "cache", "cli-manifests.json");
+  await promises.mkdir(path.dirname(cachePath), { recursive: true });
   const packages = {};
   const now = Date.now();
   const stateHasher = createHash("sha256");
   for (const result of results) {
     try {
       const manifestHash = await computeManifestHash(result.manifestPath);
-      const pkgJsonPath = path2.join(result.pkgRoot.split("/").join(path2.sep), PACKAGE_JSON);
+      const pkgJsonPath = path.join(result.pkgRoot.split("/").join(path.sep), PACKAGE_JSON);
       const pkgStat = await promises.stat(pkgJsonPath);
       const pkg = await readPackageJson(pkgJsonPath);
       const version2 = pkg?.version || "0.1.0";
-      const manifestStat = await promises.stat(result.manifestPath.split("/").join(path2.sep));
+      const manifestStat = await promises.stat(result.manifestPath.split("/").join(path.sep));
       const manifestsForCache = result.manifests.map((manifest) => {
         const manifestCopy = { ...manifest };
         delete manifestCopy.loader;
@@ -1133,17 +879,20 @@ async function discoverManifests(cwd, noCache = false) {
       const ttlMs = cached.ttlMs ?? DISK_CACHE_TTL_MS;
       const enforceHashValidation = cacheAge >= ttlMs;
       log("debug", `[plugins][cache] hit age=${cacheAge}ms ttl=${ttlMs}ms validateHash=${enforceHashValidation}`);
+      let staleCount = 0;
       for (const entry of Object.values(cached.packages)) {
         const stale = await isPackageCacheStale(entry, { validateHash: enforceHashValidation });
         if (!stale) {
           freshResults.push(entry.result);
+        } else {
+          staleCount += 1;
         }
       }
       const hasNewWorkspacePackages = await detectNewWorkspacePackages(
         cwd,
         cached.packages
       );
-      if (freshResults.length > 0 && !hasNewWorkspacePackages) {
+      if (staleCount === 0 && freshResults.length > 0 && !hasNewWorkspacePackages) {
         const totalTime2 = Date.now() - startTime;
         const sourceCounts2 = freshResults.reduce((acc, r) => {
           acc[r.source] = (acc[r.source] || 0) + 1;
@@ -1156,6 +905,9 @@ async function discoverManifests(cwd, noCache = false) {
       if (hasNewWorkspacePackages) {
         log("debug", "[plugins][cache] invalidated: new workspace packages detected");
       }
+      if (staleCount > 0) {
+        log("debug", `[plugins][cache] invalidated: ${staleCount} stale package(s) detected`);
+      }
     }
   }
   let workspace = [];
@@ -1238,168 +990,6 @@ var init_discover = __esm({
   }
 });
 
-// src/registry/plugins-state.ts
-var plugins_state_exports = {};
-__export(plugins_state_exports, {
-  clearCache: () => clearCache,
-  computePackageIntegrity: () => computePackageIntegrity,
-  disablePlugin: () => disablePlugin,
-  enablePlugin: () => enablePlugin,
-  getPluginsStatePath: () => getPluginsStatePath,
-  grantPermissions: () => grantPermissions,
-  isPluginEnabled: () => isPluginEnabled,
-  linkPlugin: () => linkPlugin,
-  loadPluginsState: () => loadPluginsState,
-  recordCrash: () => recordCrash,
-  savePluginsState: () => savePluginsState,
-  unlinkPlugin: () => unlinkPlugin
-});
-function getPluginsStatePath(cwd) {
-  return path2.join(cwd, ".kb", "plugins.json");
-}
-async function loadPluginsState(cwd) {
-  const statePath = getPluginsStatePath(cwd);
-  try {
-    const content = await promises.readFile(statePath, "utf8");
-    const state = JSON.parse(content);
-    return {
-      ...DEFAULT_STATE,
-      ...state,
-      enabled: state.enabled || [],
-      disabled: state.disabled || [],
-      linked: state.linked || [],
-      permissions: state.permissions || {},
-      integrity: state.integrity || {},
-      crashes: state.crashes || {}
-    };
-  } catch {
-    return { ...DEFAULT_STATE };
-  }
-}
-async function savePluginsState(cwd, state) {
-  const statePath = getPluginsStatePath(cwd);
-  const dir = path2.dirname(statePath);
-  await promises.mkdir(dir, { recursive: true });
-  state.lastUpdated = Date.now();
-  await promises.writeFile(statePath, JSON.stringify(state, null, 2), "utf8");
-}
-function isPluginEnabled(state, packageName, defaultEnabled = false) {
-  if (state.disabled.includes(packageName)) {
-    return false;
-  }
-  if (state.enabled.includes(packageName)) {
-    return true;
-  }
-  return defaultEnabled;
-}
-async function enablePlugin(cwd, packageName) {
-  const state = await loadPluginsState(cwd);
-  if (!state.enabled.includes(packageName)) {
-    state.enabled.push(packageName);
-  }
-  state.disabled = state.disabled.filter((p) => p !== packageName);
-  await savePluginsState(cwd, state);
-}
-async function disablePlugin(cwd, packageName) {
-  const state = await loadPluginsState(cwd);
-  if (!state.disabled.includes(packageName)) {
-    state.disabled.push(packageName);
-  }
-  state.enabled = state.enabled.filter((p) => p !== packageName);
-  await savePluginsState(cwd, state);
-}
-async function linkPlugin(cwd, pluginPath) {
-  const state = await loadPluginsState(cwd);
-  const absPath = path2.resolve(cwd, pluginPath);
-  if (!state.linked.includes(absPath)) {
-    state.linked.push(absPath);
-  }
-  await savePluginsState(cwd, state);
-}
-async function unlinkPlugin(cwd, pluginPath) {
-  const state = await loadPluginsState(cwd);
-  const absPath = path2.resolve(cwd, pluginPath);
-  state.linked = state.linked.filter((p) => p !== absPath);
-  await savePluginsState(cwd, state);
-}
-async function grantPermissions(cwd, packageName, permissions) {
-  const state = await loadPluginsState(cwd);
-  if (!state.permissions[packageName]) {
-    state.permissions[packageName] = [];
-  }
-  for (const perm of permissions) {
-    if (!state.permissions[packageName].includes(perm)) {
-      state.permissions[packageName].push(perm);
-    }
-  }
-  await savePluginsState(cwd, state);
-}
-async function recordCrash(cwd, packageName) {
-  const state = await loadPluginsState(cwd);
-  state.crashes[packageName] = (state.crashes[packageName] || 0) + 1;
-  const CRASH_THRESHOLD = 3;
-  if (state.crashes[packageName] >= CRASH_THRESHOLD && !state.disabled.includes(packageName)) {
-    state.disabled.push(packageName);
-  }
-  await savePluginsState(cwd, state);
-}
-async function computePackageIntegrity(pkgRoot) {
-  try {
-    const pkgJsonPath = path2.join(pkgRoot, "package.json");
-    const content = await promises.readFile(pkgJsonPath, "utf8");
-    const hash = createHash("sha256").update(content).digest("base64");
-    return `sha256-${hash}`;
-  } catch {
-    return "";
-  }
-}
-async function clearCache(cwd, options) {
-  const cleared = [];
-  const cacheDir = path2.join(cwd, ".kb", "cache");
-  try {
-    const entries = await promises.readdir(cacheDir);
-    for (const entry of entries) {
-      if (entry.includes("manifest") || entry.includes("plugin")) {
-        const entryPath = path2.join(cacheDir, entry);
-        await promises.unlink(entryPath);
-        cleared.push(entry);
-      }
-    }
-  } catch {
-  }
-  const modulesCleared = [];
-  if (options?.deep) {
-    try {
-      const cache = __require.cache;
-      for (const key in cache) {
-        if (key.includes("plugin") || key.includes("manifest") || key.includes("@kb-labs")) {
-          delete cache[key];
-          modulesCleared.push(key);
-        }
-      }
-    } catch {
-    }
-  }
-  return {
-    files: cleared,
-    ...options?.deep ? { modules: modulesCleared } : {}
-  };
-}
-var DEFAULT_STATE;
-var init_plugins_state = __esm({
-  "src/registry/plugins-state.ts"() {
-    DEFAULT_STATE = {
-      enabled: [],
-      disabled: [],
-      linked: [],
-      permissions: {},
-      integrity: {},
-      crashes: {},
-      lastUpdated: Date.now()
-    };
-  }
-});
-
 // src/registry/service.ts
 function manifestToCommand(registered) {
   return {
@@ -1411,7 +1001,7 @@ function manifestToCommand(registered) {
     flags: registered.manifest.flags,
     examples: registered.manifest.examples,
     async run() {
-      throw new Error(`Command ${registered.manifest.id} should be executed via V3 adapter, not via legacy run() path.`);
+      throw new Error(`Command ${registered.manifest.id} should be executed via plugin-executor, not via legacy run() path.`);
     }
   };
 }
@@ -1447,6 +1037,22 @@ var InMemoryRegistry = class {
         this.byName.set(alias, cmd);
       }
     }
+    if (group.subgroups) {
+      for (const sub of group.subgroups) {
+        const subName = `${group.name} ${sub.name}`;
+        this.groups.set(subName, sub);
+        this.byName.set(subName, sub);
+        for (const cmd of sub.commands) {
+          const fullName = `${group.name} ${sub.name} ${cmd.name}`;
+          this.systemCommands.set(fullName, cmd);
+          this.byName.set(fullName, cmd);
+          for (const alias of cmd.aliases || []) {
+            this.systemCommands.set(alias, cmd);
+            this.byName.set(alias, cmd);
+          }
+        }
+      }
+    }
   }
   registerManifest(cmd) {
     const cmdId = cmd.manifest.id;
@@ -1472,9 +1078,38 @@ var InMemoryRegistry = class {
         const spaceSeparated = cmdId.replace(/:/g, " ");
         this.byName.set(spaceSeparated, commandAdapter);
       }
-      if (cmd.manifest.group) {
+      if (cmd.manifest.group && cmd.manifest.subgroup) {
+        const fullPath = `${cmd.manifest.group} ${cmd.manifest.subgroup} ${cmd.manifest.id}`;
+        const colonPath = `${cmd.manifest.group}:${cmd.manifest.subgroup}:${cmd.manifest.id}`;
+        this.byName.set(fullPath, commandAdapter);
+        this.byName.set(colonPath, commandAdapter);
+        this.manifests.set(fullPath, cmd);
+        this.manifests.set(colonPath, cmd);
+        this.pluginCommands.set(fullPath, cmd);
+        this.pluginCommands.set(colonPath, cmd);
+        const twoPartName = `${cmd.manifest.group} ${cmd.manifest.id}`;
+        if (!this.byName.has(twoPartName)) {
+          this.byName.set(twoPartName, commandAdapter);
+        }
+        const subgroupKey = `${cmd.manifest.group} ${cmd.manifest.subgroup}`;
+        if (!this.groups.has(subgroupKey)) {
+          this.groups.set(subgroupKey, {
+            name: subgroupKey,
+            describe: cmd.manifest.subgroup,
+            commands: []
+          });
+          this.byName.set(subgroupKey, this.groups.get(subgroupKey));
+        }
+        this.groups.get(subgroupKey).commands.push(commandAdapter);
+      } else if (cmd.manifest.group) {
         const fullName = `${cmd.manifest.group} ${cmd.manifest.id}`;
+        const colonName = `${cmd.manifest.group}:${cmd.manifest.id}`;
         this.byName.set(fullName, commandAdapter);
+        this.byName.set(colonName, commandAdapter);
+        this.manifests.set(fullName, cmd);
+        this.manifests.set(colonName, cmd);
+        this.pluginCommands.set(fullName, cmd);
+        this.pluginCommands.set(colonName, cmd);
       }
       if (cmd.manifest.aliases) {
         for (const alias of cmd.manifest.aliases) {
@@ -1677,8 +1312,8 @@ function generateExamples(commandName, productName, cases) {
 // src/commands/system/hello.ts
 var hello = defineSystemCommand({
   name: "hello",
-  description: "Print a friendly greeting",
-  longDescription: "Prints a simple greeting message for testing CLI functionality",
+  description: "Print Hello World",
+  longDescription: 'Prints "Hello World" \u2014 a simple smoke-test for CLI functionality',
   category: "info",
   examples: generateExamples("hello", "kb", [
     { flags: {} }
@@ -1691,25 +1326,16 @@ var hello = defineSystemCommand({
     startEvent: "HELLO_STARTED",
     finishEvent: "HELLO_FINISHED"
   },
-  async handler(ctx, argv, flags) {
-    const who = ctx?.user ?? "KB Labs";
-    const message = `Hello, ${who}!`;
-    ctx.platform?.logger?.info("Hello command executed", { who });
+  async handler(ctx, _argv, flags) {
+    const message = "Hello World";
+    ctx.platform?.logger?.info("Hello command executed");
     if (!flags.json) {
       ctx.ui?.write(`${message}
 `);
     } else {
-      ctx.ui?.json({
-        message,
-        who,
-        status: "ready"
-      });
+      ctx.ui?.json({ message, status: "ready" });
     }
-    return {
-      ok: true,
-      message,
-      who
-    };
+    return { ok: true, message };
   }
 });
 var version = defineSystemCommand({
@@ -1732,31 +1358,31 @@ var version = defineSystemCommand({
     const v = ctx?.cliVersion ?? ctx?.env?.CLI_VERSION ?? "0.0.0";
     const cliVersion = String(v);
     const nodeVersion = process.version;
-    const platform8 = `${process.platform} ${process.arch}`;
+    const platform11 = `${process.platform} ${process.arch}`;
     ctx.platform?.logger?.info("Version command executed", {
       version: cliVersion,
       nodeVersion,
-      platform: platform8
+      platform: platform11
     });
     if (!flags.json) {
       ctx.ui?.write(`KB Labs CLI v${cliVersion}
 `);
       ctx.ui?.write(`Node: ${nodeVersion}
 `);
-      ctx.ui?.write(`Platform: ${platform8}
+      ctx.ui?.write(`Platform: ${platform11}
 `);
     } else {
       ctx.ui?.json({
         version: cliVersion,
         nodeVersion,
-        platform: platform8
+        platform: platform11
       });
     }
     return {
       ok: true,
       version: cliVersion,
       nodeVersion,
-      platform: platform8
+      platform: platform11
     };
   }
 });
@@ -1778,8 +1404,8 @@ var health = defineSystemCommand({
     finishEvent: "HEALTH_FINISHED"
   },
   async handler(ctx, _argv, _flags) {
-    const cliApi = await createCliAPI({
-      cache: { inMemory: true, ttlMs: 5e3 }
+    const cliApi = await createRegistry({
+      cache: { ttlMs: 5e3 }
     });
     try {
       ctx.platform?.logger?.info("Health check started");
@@ -1867,7 +1493,6 @@ var health = defineSystemCommand({
   }
 });
 init_discover();
-init_plugins_state();
 var diag = defineSystemCommand({
   name: "diag",
   description: "Comprehensive system diagnostics (plugins, cache, environment, versions)",
@@ -1890,13 +1515,13 @@ var diag = defineSystemCommand({
     const diagnostics = [];
     const nodeVersion = process.version;
     const cliVersion = process.env.CLI_VERSION || process.env.CLI_VERSION || "0.1.0";
-    const platform8 = process.platform;
+    const platform11 = process.platform;
     const arch = process.arch;
     diagnostics.push({
       category: "environment",
       status: "ok",
-      message: `Node ${nodeVersion}, CLI ${cliVersion}, ${platform8}/${arch}`,
-      details: { nodeVersion, cliVersion, platform: platform8, arch }
+      message: `Node ${nodeVersion}, CLI ${cliVersion}, ${platform11}/${arch}`,
+      details: { nodeVersion, cliVersion, platform: platform11, arch }
     });
     try {
       const discovered = await discoverManifests(cwd, false);
@@ -1905,7 +1530,7 @@ var diag = defineSystemCommand({
       const disabled = manifests.filter((m) => !m.available).length;
       const shadowed = manifests.filter((m) => m.shadowed).length;
       diagnostics.push({
-        category: "plugins",
+        category: "marketplace",
         status: disabled > 0 ? "warning" : "ok",
         message: `Found ${discovered.length} packages, ${enabled} enabled, ${disabled} unavailable, ${shadowed} shadowed`,
         details: {
@@ -1918,14 +1543,14 @@ var diag = defineSystemCommand({
       });
     } catch (err) {
       diagnostics.push({
-        category: "plugins",
+        category: "marketplace",
         status: "error",
         message: `Discovery failed: ${err.message}`,
         details: { error: err.message }
       });
     }
     try {
-      const cachePath = path2.join(cwd, ".kb", "cache", "cli-manifests.json");
+      const cachePath = path.join(cwd, ".kb", "cache", "cli-manifests.json");
       const cacheExists = await promises.access(cachePath).then(() => true).catch(() => false);
       if (cacheExists) {
         const cache = JSON.parse(await promises.readFile(cachePath, "utf8"));
@@ -1958,26 +1583,29 @@ var diag = defineSystemCommand({
       });
     }
     try {
-      const state = await loadPluginsState(cwd);
-      const enabledCount = state.enabled.length;
-      const disabledCount = state.disabled.length;
-      const linkedCount = state.linked.length;
-      diagnostics.push({
-        category: "plugins-state",
-        status: "ok",
-        message: `${enabledCount} enabled, ${disabledCount} disabled, ${linkedCount} linked`,
-        details: {
-          enabled: enabledCount,
-          disabled: disabledCount,
-          linked: linkedCount,
-          permissions: Object.keys(state.permissions).length
-        }
-      });
+      const lock = await readMarketplaceLock(cwd, new DiagnosticCollector());
+      if (lock) {
+        const entries = Object.entries(lock.installed);
+        const enabledCount = entries.filter(([, e]) => e.enabled !== false).length;
+        const disabledCount = entries.length - enabledCount;
+        diagnostics.push({
+          category: "marketplace-lock",
+          status: "ok",
+          message: `${entries.length} installed (${enabledCount} enabled, ${disabledCount} disabled)`,
+          details: { total: entries.length, enabled: enabledCount, disabled: disabledCount }
+        });
+      } else {
+        diagnostics.push({
+          category: "marketplace-lock",
+          status: "warning",
+          message: "No marketplace.lock found \u2014 no plugins installed via marketplace"
+        });
+      }
     } catch (err) {
       diagnostics.push({
-        category: "plugins-state",
+        category: "marketplace-lock",
         status: "error",
-        message: `State check failed: ${err.message}`,
+        message: `Marketplace lock check failed: ${err.message}`,
         details: { error: err.message }
       });
     }
@@ -2066,10 +1694,10 @@ var diag = defineSystemCommand({
       }
       const nextSteps = [];
       if (hasErrors) {
-        nextSteps.push(`kb plugins doctor  ${safeColors.muted("Diagnose plugin issues")}`);
+        nextSteps.push(`kb marketplace doctor  ${safeColors.muted("Diagnose plugin issues")}`);
       }
       if (hasWarnings) {
-        nextSteps.push(`kb plugins ls  ${safeColors.muted("List all plugins")}`);
+        nextSteps.push(`kb marketplace list  ${safeColors.muted("List all plugins")}`);
       }
       nextSteps.push(`kb diagnose  ${safeColors.muted("Quick environment check")}`);
       const sections = [
@@ -2082,1475 +1710,119 @@ var diag = defineSystemCommand({
           items: diagItems
         },
         {
-          header: "Next Steps",
-          items: nextSteps
-        }
-      ];
-      if (hasErrors) {
-        ctx.ui.error("System Diagnostics", { sections });
-      } else if (hasWarnings) {
-        ctx.ui.warn("System Diagnostics", { sections });
-      } else {
-        ctx.ui.success("System Diagnostics", { sections });
-      }
-    }
-  }
-});
-init_plugins_state();
-var pluginsList = defineSystemCommand({
-  name: "list",
-  description: "List all discovered CLI plugins",
-  category: "plugins",
-  // Type-safe examples using generateExamples()
-  examples: generateExamples("list", "plugins", [
-    { flags: {} },
-    // kb plugins list
-    { flags: { json: true } }
-    // kb plugins list --json
-  ]),
-  flags: {
-    json: { type: "boolean", description: "Output in JSON format" }
-  },
-  analytics: {
-    command: "plugins:list",
-    startEvent: "PLUGINS_LIST_STARTED",
-    finishEvent: "PLUGINS_LIST_FINISHED"
-  },
-  async handler(ctx, _argv, _flags) {
-    const cwd = getContextCwd(ctx);
-    const pluginRegistry = new PluginRegistry({
-      strategies: ["workspace", "pkg", "dir", "file"],
-      roots: [cwd]
-    });
-    await pluginRegistry.refresh();
-    const manifests = registry.listManifests();
-    const productGroups = registry.listProductGroups();
-    const state = await loadPluginsState(cwd);
-    pluginRegistry.list();
-    const packages = /* @__PURE__ */ new Map();
-    for (const cmd of manifests) {
-      const pkgName = cmd.manifest.package || cmd.manifest.group;
-      const namespace = cmd.manifest.namespace || cmd.manifest.group;
-      if (!packages.has(pkgName)) {
-        let version2 = "unknown";
-        if (cmd.pkgRoot) {
-          try {
-            const pkgPath = path2.join(cmd.pkgRoot, "package.json");
-            const pkgJson = JSON.parse(await promises.readFile(pkgPath, "utf8"));
-            version2 = pkgJson.version || "unknown";
-          } catch {
-          }
-        }
-        if (version2 === "unknown") {
-          try {
-            const pkgPath = path2.join(cwd, "node_modules", pkgName, "package.json");
-            const pkgJson = JSON.parse(await promises.readFile(pkgPath, "utf8"));
-            version2 = pkgJson.version || "unknown";
-          } catch {
-            try {
-              const pkgPath = path2.join(cwd, "packages", namespace.replace("@kb-labs/", "").replace("-cli", ""), "package.json");
-              const pkgJson = JSON.parse(await promises.readFile(pkgPath, "utf8"));
-              version2 = pkgJson.version || "unknown";
-            } catch {
-              try {
-                const workspaceRoot = path2.resolve(cwd, "..");
-                const pkgDirs = await promises.readdir(path2.join(workspaceRoot, "packages"), { withFileTypes: true });
-                for (const dir of pkgDirs) {
-                  if (dir.isDirectory()) {
-                    try {
-                      const pkgPath = path2.join(workspaceRoot, "packages", dir.name, "package.json");
-                      const pkgJson = JSON.parse(await promises.readFile(pkgPath, "utf8"));
-                      if (pkgJson.name === pkgName) {
-                        version2 = pkgJson.version || "unknown";
-                        break;
-                      }
-                    } catch {
-                    }
-                  }
-                }
-              } catch {
-              }
-            }
-          }
-        }
-        const enabled = isPluginEnabled(state, pkgName, cmd.source === "workspace" || cmd.source === "linked");
-        let pluginState = enabled ? "enabled" : "disabled";
-        if (cmd.source === "linked") {
-          pluginState = "linked";
-        } else if (!cmd.available) {
-          pluginState = "error";
-        }
-        packages.set(pkgName, {
-          name: pkgName,
-          namespace,
-          version: version2,
-          source: cmd.source,
-          enabled,
-          commands: [],
-          state: pluginState
-        });
-      }
-      packages.get(pkgName).commands.push(cmd);
-    }
-    const packageList = Array.from(packages.values()).sort((a, b) => a.name.localeCompare(b.name));
-    const output = packageList.map((pkg) => ({
-      name: pkg.name,
-      namespace: pkg.namespace,
-      version: pkg.version,
-      source: pkg.source,
-      enabled: pkg.enabled,
-      state: pkg.state,
-      commands: pkg.commands.map((cmd) => ({
-        id: cmd.manifest.id,
-        aliases: cmd.manifest.aliases || [],
-        describe: cmd.manifest.describe,
-        available: cmd.available,
-        shadowed: cmd.shadowed,
-        ...cmd.unavailableReason && { reason: cmd.unavailableReason }
-      }))
-    }));
-    const totalPlugins = output.length;
-    const enabledCount = output.filter((p) => p.enabled).length;
-    const disabledCount = output.filter((p) => !p.enabled).length;
-    const linkedCount = packageList.filter((p) => p.state === "linked").length;
-    ctx.platform?.logger?.info("Plugins list completed", {
-      total: totalPlugins,
-      enabled: enabledCount,
-      disabled: disabledCount,
-      products: productGroups.length
-    });
-    const sections = [];
-    sections.push({
-      header: "Summary",
-      items: [
-        `${safeColors.bold("Total")}: ${totalPlugins} plugins`,
-        `${safeColors.bold("Enabled")}: ${enabledCount}`,
-        `${safeColors.bold("Disabled")}: ${disabledCount}`,
-        `${safeColors.bold("Linked")}: ${linkedCount}`,
-        `${safeColors.bold("Commands")}: ${manifests.length} total`
-      ]
-    });
-    const stateIcons = {
-      enabled: "\u2705",
-      disabled: "\u23F8",
-      error: "\u274C",
-      outdated: "\u26A0",
-      linked: "\u{1F9E9}"
-    };
-    const columns = [
-      { header: "Plugin", align: "left" },
-      { header: "NS", align: "left" },
-      { header: "Version", align: "left" },
-      { header: "Source", align: "left" },
-      { header: "State", align: "left" },
-      { header: "Cmds", align: "right" }
-    ];
-    const tableRows = packageList.map((pkg) => {
-      const stateIcon = stateIcons[pkg.state] || "\u2753";
-      const name = pkg.name.length > 26 ? pkg.name.substring(0, 23) + "..." : pkg.name;
-      const sourceLabel = pkg.source === "workspace" ? "workspace" : pkg.source === "linked" ? "linked" : "node_modules";
-      const stateDisplay = `${stateIcon} ${pkg.state}`;
-      return [name, pkg.namespace, pkg.version, sourceLabel, stateDisplay, String(pkg.commands.length)];
-    });
-    const tableLines = formatTable(columns, tableRows, { separator: "\u2500", padding: 2 });
-    const errorLines = [];
-    for (const pkg of packageList) {
-      const hasErrors = pkg.commands.some((c) => !c.available || c.shadowed);
-      if (hasErrors) {
-        for (const cmd of pkg.commands) {
-          if (!cmd.available) {
-            errorLines.push(
-              `  ${safeColors.muted("\u274C")} ${cmd.manifest.id}: ${cmd.unavailableReason || "unavailable"}`
-            );
-            if (cmd.hint) {
-              errorLines.push(`     ${safeColors.warning(`Hint: ${cmd.hint}`)}`);
-            }
-          }
-          if (cmd.shadowed) {
-            errorLines.push(`  ${safeColors.muted("\u26A0")} ${cmd.manifest.id}: shadowed`);
-          }
-        }
-      }
-    }
-    const pluginsItems = [...tableLines];
-    if (errorLines.length > 0) {
-      pluginsItems.push("", ...errorLines);
-    }
-    sections.push({
-      header: "Plugins",
-      items: pluginsItems
-    });
-    sections.push({
-      header: "Next Steps",
-      items: [
-        `kb plugins enable <name>  ${safeColors.muted("Enable a plugin")}`,
-        `kb plugins disable <name>  ${safeColors.muted("Disable a plugin")}`,
-        `kb plugins doctor  ${safeColors.muted("Diagnose plugin issues")}`,
-        `kb plugins --json  ${safeColors.muted("Get machine-readable output")}`
-      ]
-    });
-    return {
-      ok: true,
-      status: "success",
-      message: `Found ${totalPlugins} plugins (${enabledCount} enabled, ${disabledCount} disabled)`,
-      sections,
-      json: {
-        plugins: output,
-        total: totalPlugins,
-        enabled: enabledCount,
-        disabled: disabledCount,
-        products: productGroups.length
-      }
-    };
-  },
-  formatter(result, ctx, flags) {
-    if (flags.json) {
-      console.log(JSON.stringify(result.json, null, 2));
-    } else {
-      ctx.ui.info("KB Labs CLI Plugins", { sections: result.sections });
-    }
-  }
-});
-var pluginsCommands = defineSystemCommand({
-  name: "commands",
-  description: "Show all plugin commands with their real invocation syntax",
-  category: "plugins",
-  examples: generateExamples("commands", "plugins", [
-    { flags: {} },
-    { flags: { plugin: "@kb-labs/mind" } },
-    { flags: { sort: "count" } },
-    { flags: { json: true } }
-  ]),
-  flags: {
-    json: { type: "boolean", description: "Output in JSON format" },
-    plugin: { type: "string", description: "Filter by plugin ID" },
-    sort: { type: "string", description: "Sort order: alpha (default), count, type" }
-  },
-  async handler(ctx, argv, flags) {
-    const commands = registry.list();
-    registry.listGroups();
-    const grouped = {};
-    for (const cmd of commands) {
-      const groupName = cmd.name.split(/[\s:]/)[0] ?? cmd.name;
-      if (!grouped[groupName]) {
-        grouped[groupName] = [];
-      }
-      grouped[groupName].push(cmd);
-    }
-    const pluginFilter = flags.plugin ?? "";
-    const filteredGroups = pluginFilter ? Object.fromEntries(
-      Object.entries(grouped).filter(([name, cmds]) => {
-        if (name === pluginFilter || name.includes(pluginFilter)) {
-          return true;
-        }
-        return cmds.some((cmd) => cmd.category === pluginFilter || cmd.category?.includes(pluginFilter));
-      })
-    ) : grouped;
-    const totalCommands = Object.values(filteredGroups).reduce((sum, cmds) => sum + cmds.length, 0);
-    const totalGroups = Object.keys(filteredGroups).length;
-    const sortOrder = flags.sort || "alpha";
-    const validSorts = ["alpha", "count", "type"];
-    if (!validSorts.includes(sortOrder)) {
-      throw new Error(`Invalid sort order: ${sortOrder}. Valid options: ${validSorts.join(", ")}`);
-    }
-    if (flags.json) {
-      const output = {};
-      for (const [groupName, cmds] of Object.entries(filteredGroups)) {
-        output[groupName] = cmds.map((cmd) => ({
-          name: cmd.name,
-          description: cmd.describe || "",
-          category: cmd.category
-        }));
-      }
-      return {
-        ok: true,
-        status: "success",
-        message: `Found ${totalCommands} commands in ${totalGroups} groups`,
-        json: {
-          groups: output,
-          totalGroups,
-          totalCommands
-        }
-      };
-    }
-    const sections = [];
-    sections.push({
-      header: "Summary",
-      items: [
-        `${safeColors.bold("Groups")}: ${totalGroups}`,
-        `${safeColors.bold("Commands")}: ${totalCommands}`,
-        `${safeColors.bold("Sort")}: ${sortOrder}`,
-        ...flags.plugin ? [`${safeColors.bold("Filter")}: ${flags.plugin}`] : []
-      ]
-    });
-    const sortGroups = (entries) => {
-      switch (sortOrder) {
-        case "count":
-          return entries.sort(([, a], [, b]) => b.length - a.length);
-        case "type":
-          return entries.sort(([a], [b]) => a.localeCompare(b));
-        case "alpha":
-        default:
-          return entries.sort(([a], [b]) => a.localeCompare(b));
-      }
-    };
-    const systemGroups = [];
-    const productGroups = [];
-    const sortedGroups = Object.entries(filteredGroups);
-    for (const [groupName, cmds] of sortedGroups) {
-      const isSystemGroup = cmds.some(
-        (cmd) => cmd.category && ["plugins", "jobs", "workflow", "worker", "debug", "info", "logging", "registry"].includes(cmd.category)
-      );
-      if (isSystemGroup) {
-        systemGroups.push([groupName, cmds]);
-      } else {
-        productGroups.push([groupName, cmds]);
-      }
-    }
-    if (systemGroups.length > 0) {
-      const systemItems = [];
-      const sortedSystemGroups = sortGroups(systemGroups);
-      for (const [groupName, cmds] of sortedSystemGroups) {
-        systemItems.push("");
-        systemItems.push(`\u2699\uFE0F  ${safeColors.bold(groupName)} ${safeColors.muted(`(${cmds.length})`)}`);
-        const sortedCmds = cmds.sort((a, b) => a.name.localeCompare(b.name));
-        for (const cmd of sortedCmds) {
-          const invocation = safeColors.bold(`kb ${cmd.name}`);
-          const description = cmd.describe ? ` ${safeColors.muted(cmd.describe)}` : "";
-          systemItems.push(`  ${invocation}${description}`);
-        }
-      }
-      sections.push({
-        header: "System Commands",
-        items: systemItems
-      });
-    }
-    if (productGroups.length > 0) {
-      const productItems = [];
-      const sortedProductGroups = sortGroups(productGroups);
-      for (const [groupName, cmds] of sortedProductGroups) {
-        productItems.push("");
-        productItems.push(`\u{1F4E6} ${safeColors.bold(groupName)} ${safeColors.muted(`(${cmds.length})`)}`);
-        const sortedCmds = cmds.sort((a, b) => a.name.localeCompare(b.name));
-        for (const cmd of sortedCmds) {
-          const invocation = safeColors.bold(`kb ${cmd.name}`);
-          const description = cmd.describe ? ` ${safeColors.muted(cmd.describe)}` : "";
-          productItems.push(`  ${invocation}${description}`);
-        }
-      }
-      sections.push({
-        header: "Product Commands",
-        items: productItems
-      });
-    }
-    sections.push({
-      header: "Next Steps",
-      items: [
-        `kb plugins commands --plugin <name>  ${safeColors.muted("Filter by plugin")}`,
-        `kb plugins commands --sort <order>  ${safeColors.muted("Sort: alpha, count, type")}`,
-        `kb plugins commands --json  ${safeColors.muted("Get machine-readable output")}`,
-        `kb plugins list  ${safeColors.muted("Show installed plugins")}`
-      ]
-    });
-    const jsonGroups = {};
-    for (const [groupName, cmds] of Object.entries(filteredGroups)) {
-      jsonGroups[groupName] = cmds.map((cmd) => ({
-        name: cmd.name,
-        description: cmd.describe || "",
-        category: cmd.category
-      }));
-    }
-    return {
-      ok: true,
-      status: "success",
-      message: `Found ${totalCommands} commands in ${totalGroups} groups`,
-      sections,
-      json: {
-        groups: jsonGroups,
-        totalGroups,
-        totalCommands
-      }
-    };
-  },
-  formatter(result, ctx, flags) {
-    if (flags.json) {
-      console.log(JSON.stringify(result.json, null, 2));
-    } else {
-      ctx.ui.success("Plugin Commands Registry", { sections: result.sections ?? [] });
-    }
-  }
-});
-init_plugins_state();
-var pluginsEnable = defineSystemCommand({
-  name: "enable",
-  description: "Enable a plugin",
-  category: "plugins",
-  examples: generateExamples("enable", "plugins", [
-    { flags: {} },
-    // kb plugins enable (will need <package> arg in actual usage)
-    { flags: { perm: ["fs.write"] } }
-    // kb plugins enable --perm fs.write
-  ]),
-  flags: {
-    perm: {
-      type: "array",
-      description: "Grant specific permissions (e.g., --perm fs.write --perm net.fetch)"
-    }
-  },
-  analytics: {
-    command: "plugins:enable",
-    startEvent: "PLUGINS_ENABLE_STARTED",
-    finishEvent: "PLUGINS_ENABLE_FINISHED"
-  },
-  async handler(ctx, argv, flags) {
-    if (argv.length === 0) {
-      throw new Error("Please specify a plugin name to enable");
-    }
-    const packageName = argv[0];
-    if (!packageName) {
-      throw new Error("Please specify a plugin name to enable");
-    }
-    const permissions = Array.isArray(flags.perm) ? flags.perm.map(String) : [];
-    const cwd = getContextCwd(ctx);
-    ctx.platform?.logger?.info("Enabling plugin", { packageName, permissions });
-    await enablePlugin(cwd, packageName);
-    if (permissions.length > 0) {
-      const { grantPermissions: grantPermissions2 } = await Promise.resolve().then(() => (init_plugins_state(), plugins_state_exports));
-      await grantPermissions2(cwd, packageName, permissions);
-      ctx.platform?.logger?.info("Plugin enabled with permissions", { packageName, permissions });
-      return {
-        ok: true,
-        packageName,
-        permissions,
-        message: `Enabled ${packageName} with permissions: ${permissions.join(", ")}`
-      };
-    } else {
-      ctx.platform?.logger?.info("Plugin enabled", { packageName });
-      return {
-        ok: true,
-        packageName,
-        message: `Enabled ${packageName}`
-      };
-    }
-  },
-  formatter(result, ctx, _flags) {
-    ctx.ui.info(result.message ?? "Plugin enabled");
-    ctx.ui.info(`Run 'kb plugins ls' to see updated status`);
-  }
-});
-init_plugins_state();
-var pluginsDisable = defineSystemCommand({
-  name: "disable",
-  description: "Disable a plugin",
-  category: "plugins",
-  examples: generateExamples("disable", "plugins", [
-    { flags: {} }
-    // kb plugins disable (requires <package> arg)
-  ]),
-  flags: {},
-  analytics: {
-    command: "plugins:disable",
-    startEvent: "PLUGINS_DISABLE_STARTED",
-    finishEvent: "PLUGINS_DISABLE_FINISHED"
-  },
-  async handler(ctx, argv, _flags) {
-    if (argv.length === 0) {
-      throw new Error("Please specify a plugin name to disable");
-    }
-    const packageName = argv[0];
-    if (!packageName) {
-      throw new Error("Please specify a plugin name to disable");
-    }
-    const cwd = getContextCwd(ctx);
-    ctx.platform?.logger?.info("Disabling plugin", { packageName });
-    await disablePlugin(cwd, packageName);
-    ctx.platform?.logger?.info("Plugin disabled", { packageName });
-    return {
-      ok: true,
-      packageName,
-      message: `Disabled ${packageName}`
-    };
-  },
-  formatter(result, ctx, _flags) {
-    ctx.ui.info(result.message ?? "Plugin disabled");
-    ctx.ui.info(`Run 'kb plugins ls' to see updated status`);
-  }
-});
-init_plugins_state();
-var pluginsLink = defineSystemCommand({
-  name: "link",
-  description: "Link a local plugin for development",
-  category: "plugins",
-  examples: generateExamples("link", "plugins", [
-    { flags: {} }
-    // kb plugins link (requires <path> arg)
-  ]),
-  flags: {},
-  analytics: {
-    command: "plugins:link",
-    startEvent: "PLUGINS_LINK_STARTED",
-    finishEvent: "PLUGINS_LINK_FINISHED"
-  },
-  async handler(ctx, argv, _flags) {
-    if (argv.length === 0) {
-      throw new Error("Please specify a plugin path to link");
-    }
-    const pluginPath = argv[0];
-    if (!pluginPath) {
-      throw new Error("Please specify a plugin path to link");
-    }
-    const cwd = getContextCwd(ctx);
-    const absPath = path2.resolve(cwd, pluginPath);
-    ctx.platform?.logger?.info("Linking plugin", { pluginPath, absPath });
-    const pkgJsonPath = path2.join(absPath, "package.json");
-    await promises.access(pkgJsonPath);
-    const pkgJson = JSON.parse(await promises.readFile(pkgJsonPath, "utf8"));
-    const hasManifest = pkgJson.kb?.commandsManifest || pkgJson.exports?.["./kb/commands"];
-    if (!hasManifest) {
-      ctx.platform?.logger?.warn("Plugin may not be valid", { packageName: pkgJson.name, pluginPath });
-    }
-    await linkPlugin(cwd, absPath);
-    ctx.platform?.logger?.info("Plugin linked", { packageName: pkgJson.name, absPath });
-    let configUpdated = false;
-    try {
-      const configPath = path2.join(cwd, ".kb", "kb.config.json");
-      const config = JSON.parse(await promises.readFile(configPath, "utf8"));
-      if (!config.plugins) {
-        config.plugins = {};
-      }
-      if (!config.plugins.linked) {
-        config.plugins.linked = [];
-      }
-      if (!config.plugins.linked.includes(pkgJson.name)) {
-        config.plugins.linked.push(pkgJson.name);
-        await promises.writeFile(configPath, JSON.stringify(config, null, 2), "utf8");
-        configUpdated = true;
-      }
-    } catch {
-    }
-    return {
-      ok: true,
-      packageName: pkgJson.name || pluginPath,
-      absPath,
-      hasManifest: !!hasManifest,
-      configUpdated,
-      message: `Linked ${pkgJson.name || pluginPath} from ${absPath}`
-    };
-  },
-  formatter(result, ctx, _flags) {
-    if (!result.hasManifest) {
-      ctx.ui.warn(
-        `Package ${result.packageName ?? "unknown"} doesn't appear to be a KB CLI plugin`
-      );
-      ctx.ui.info('Add "kb.commandsManifest" or "exports["./kb/commands"]" to package.json');
-    }
-    ctx.ui.info(result.message ?? "Plugin linked");
-    if (result.configUpdated) {
-      ctx.ui.info(`Added ${result.packageName ?? "unknown"} to kb.config.json plugins.linked`);
-    }
-    ctx.ui.info(`The plugin will be discovered on next CLI run`);
-  }
-});
-init_plugins_state();
-var pluginsUnlink = defineSystemCommand({
-  name: "unlink",
-  description: "Unlink a local plugin",
-  category: "plugins",
-  examples: generateExamples("unlink", "plugins", [
-    { flags: {} }
-    // kb plugins unlink (requires <path-or-name> arg)
-  ]),
-  flags: {},
-  analytics: {
-    command: "plugins:unlink",
-    startEvent: "PLUGINS_UNLINK_STARTED",
-    finishEvent: "PLUGINS_UNLINK_FINISHED"
-  },
-  async handler(ctx, argv, _flags) {
-    if (argv.length === 0) {
-      throw new Error("Please specify a plugin path or name to unlink");
-    }
-    const identifier = argv[0];
-    if (!identifier) {
-      throw new Error("Please specify a plugin path or name to unlink");
-    }
-    const cwd = getContextCwd(ctx);
-    const state = await loadPluginsState(cwd);
-    ctx.platform?.logger?.info("Unlinking plugin", { identifier });
-    let absPath;
-    try {
-      absPath = path2.resolve(cwd, identifier);
-      await promises.access(absPath);
-    } catch {
-      const matched = state.linked.find((p) => p.includes(identifier) || p.endsWith(identifier));
-      if (matched) {
-        absPath = matched;
-      } else {
-        ctx.platform?.logger?.warn("Plugin not found", { identifier, linkedPlugins: state.linked });
-        throw new Error(`Plugin not found: ${identifier}`);
-      }
-    }
-    if (!absPath) {
-      ctx.platform?.logger?.warn("Plugin not found", { identifier });
-      throw new Error(`Plugin not found: ${identifier}`);
-    }
-    await unlinkPlugin(cwd, absPath);
-    ctx.platform?.logger?.info("Plugin unlinked", { identifier, absPath });
-    return {
-      ok: true,
-      identifier,
-      absPath,
-      message: `Unlinked ${identifier}`
-    };
-  },
-  formatter(result, ctx, _flags) {
-    ctx.ui.info(result.message ?? "Plugin unlinked");
-    ctx.ui.info(`Run 'kb plugins ls' to see updated status`);
-  }
-});
-function detectRepoRoot(start = process.cwd()) {
-  let cur = path2.resolve(start);
-  while (true) {
-    if (existsSync(path2.join(cur, ".git"))) {
-      return cur;
-    }
-    const parent = path2.dirname(cur);
-    if (parent === cur) {
-      return start;
-    }
-    cur = parent;
-  }
-}
-async function findRestApiManifestPath(pkgRoot, pkg) {
-  if (pkg.kbLabs?.manifest) {
-    const manifestPath = path2.isAbsolute(pkg.kbLabs.manifest) ? pkg.kbLabs.manifest : path2.join(pkgRoot, pkg.kbLabs.manifest);
-    try {
-      await promises.access(manifestPath);
-      return manifestPath;
-    } catch {
-      return null;
-    }
-  }
-  if (pkg.kb?.manifest) {
-    const manifestPath = path2.isAbsolute(pkg.kb.manifest) ? pkg.kb.manifest : path2.join(pkgRoot, pkg.kb.manifest);
-    try {
-      await promises.access(manifestPath);
-      return manifestPath;
-    } catch {
-      return null;
-    }
-  }
-  if (Array.isArray(pkg.kbLabs?.plugins)) {
-    for (const pluginPath of pkg.kbLabs.plugins) {
-      const manifestPath = path2.isAbsolute(pluginPath) ? pluginPath : path2.join(pkgRoot, pluginPath);
-      try {
-        await promises.access(manifestPath);
-        return manifestPath;
-      } catch {
-        continue;
-      }
-    }
-  }
-  if (Array.isArray(pkg.kb?.plugins)) {
-    for (const pluginPath of pkg.kb.plugins) {
-      const manifestPath = path2.isAbsolute(pluginPath) ? pluginPath : path2.join(pkgRoot, pluginPath);
-      try {
-        await promises.access(manifestPath);
-        return manifestPath;
-      } catch {
-        continue;
-      }
-    }
-  }
-  const pluginsDir = path2.join(pkgRoot, ".kblabs", "plugins");
-  try {
-    const entries = await promises.readdir(pluginsDir, { withFileTypes: true });
-    for (const entry of entries) {
-      if (entry.isFile() && (entry.name.endsWith(".ts") || entry.name.endsWith(".js"))) {
-        return path2.join(pluginsDir, entry.name);
-      }
-    }
-  } catch {
-  }
-  const conventionalPaths = [
-    path2.join(pkgRoot, "dist", "manifest.v2.js"),
-    path2.join(pkgRoot, "dist", "manifest.v2.ts"),
-    path2.join(pkgRoot, "src", "manifest.v2.ts"),
-    path2.join(pkgRoot, "manifest.v2.ts"),
-    path2.join(pkgRoot, "manifest.v2.js")
-  ];
-  for (const manifestPath of conventionalPaths) {
-    try {
-      await promises.access(manifestPath);
-      return manifestPath;
-    } catch {
-      continue;
-    }
-  }
-  return null;
-}
-async function discoverRestApiPlugins(repoRoot) {
-  const results = [];
-  const workspaceYaml = path2.join(repoRoot, "pnpm-workspace.yaml");
-  let workspacePatterns = [];
-  try {
-    const content = await promises.readFile(workspaceYaml, "utf8");
-    const parsed = parse(content);
-    workspacePatterns = parsed.packages || [];
-  } catch {
-    workspacePatterns = ["packages/*", "apps/*"];
-  }
-  if (workspacePatterns.length === 0) {
-    let currentDir = repoRoot;
-    for (let i = 0; i < 3; i++) {
-      const parentYaml = path2.join(path2.dirname(currentDir), "pnpm-workspace.yaml");
-      try {
-        const content = await promises.readFile(parentYaml, "utf8");
-        const parsed = parse(content);
-        if (parsed.packages && parsed.packages.length > 0) {
-          workspacePatterns = parsed.packages;
-          repoRoot = path2.dirname(currentDir);
-          break;
-        }
-      } catch {
-      }
-      currentDir = path2.dirname(currentDir);
-      if (currentDir === path2.dirname(currentDir)) {
-        break;
-      }
-    }
-  }
-  const packageJsonPaths = [];
-  for (const pattern of workspacePatterns) {
-    const pkgPattern = pattern.endsWith("/package.json") ? pattern : pattern.endsWith("/*") ? `${pattern}/package.json` : `${pattern}/**/package.json`;
-    try {
-      const matches = await glob(pkgPattern, {
-        cwd: repoRoot,
-        absolute: true,
-        ignore: ["**/node_modules/**", "**/.kb/**"]
-      });
-      packageJsonPaths.push(...matches);
-    } catch {
-    }
-  }
-  const uniquePaths = Array.from(new Set(packageJsonPaths));
-  for (const pkgJsonPath of uniquePaths) {
-    const pkgRoot = path2.dirname(pkgJsonPath);
-    try {
-      const pkgContent = await promises.readFile(pkgJsonPath, "utf8");
-      const pkg = JSON.parse(pkgContent);
-      const manifestPath = await findRestApiManifestPath(pkgRoot, pkg);
-      if (!manifestPath) {
-        continue;
-      }
-      try {
-        const module = await import(manifestPath);
-        const manifest = module.default || module.manifest || module;
-        if (manifest && typeof manifest === "object" && "schema" in manifest && manifest.schema === "kb.plugin/2" && "rest" in manifest && manifest.rest && typeof manifest.rest === "object" && "routes" in manifest.rest && Array.isArray(manifest.rest.routes) && manifest.rest.routes.length > 0) {
-          const manifestV2 = manifest;
-          results.push({
-            manifest: manifestV2,
-            manifestPath: path2.resolve(manifestPath),
-            pluginRoot: pkgRoot
-          });
-        }
-      } catch (_e) {
-        continue;
-      }
-    } catch {
-      continue;
-    }
-  }
-  return results;
-}
-var pluginsRegistry = defineSystemCommand({
-  name: "registry",
-  description: "List all REST API plugin manifests for REST API server",
-  category: "plugins",
-  examples: generateExamples("registry", "plugins", [
-    { flags: {} },
-    { flags: { json: true } }
-  ]),
-  flags: {
-    json: { type: "boolean", description: "Output in JSON format" }
-  },
-  analytics: {
-    command: "plugins:registry",
-    startEvent: "PLUGINS_REGISTRY_STARTED",
-    finishEvent: "PLUGINS_REGISTRY_FINISHED"
-  },
-  async handler(ctx, argv, flags) {
-    const cwd = getContextCwd(ctx);
-    const repoRoot = detectRepoRoot(cwd);
-    const restApiPlugins = await discoverRestApiPlugins(repoRoot);
-    const manifests = restApiPlugins;
-    const manifestsWithPaths = manifests.map((p) => ({
-      manifest: p.manifest,
-      manifestPath: p.manifestPath,
-      pluginRoot: p.pluginRoot
-    }));
-    ctx.platform?.logger?.info("Plugins registry scan completed", { count: manifests.length });
-    if (flags.json) {
-      ctx.ui.json({
-        ok: true,
-        manifests: manifests.map((p) => p.manifest),
-        manifestsWithPaths,
-        total: manifests.length
-      });
-      return {
-        ok: true,
-        manifests: manifests.map((p) => p.manifest),
-        manifestsWithPaths,
-        total: manifests.length,
-        plugins: manifests
-      };
-    }
-    const sections = [
-      {
-        header: "Summary",
-        items: [
-          `Found: ${manifests.length} REST API plugin(s)`,
-          `Repository: ${repoRoot}`
-        ]
-      }
-    ];
-    if (manifests.length > 0) {
-      const pluginItems = [];
-      for (const plugin of manifests) {
-        const displayName = plugin.manifest.display?.name || plugin.manifest.id;
-        const routesCount = plugin.manifest.rest?.routes?.length || 0;
-        pluginItems.push(
-          `${ctx.ui.symbols.success} ${plugin.manifest.id}@${plugin.manifest.version} - ${displayName}`
-        );
-        pluginItems.push(`  Path: ${plugin.manifestPath}`);
-        pluginItems.push(`  Routes: ${routesCount}`);
-      }
-      sections.push({
-        header: "Plugins",
-        items: pluginItems
-      });
-    } else {
-      sections.push({
-        items: ["No REST API plugins found"]
-      });
-    }
-    ctx.ui.info("Plugins Registry", { sections });
-    return {
-      ok: true,
-      manifests: manifests.map((p) => p.manifest),
-      manifestsWithPaths,
-      total: manifests.length,
-      plugins: manifests
-    };
-  }
-});
-var require2 = createRequire(import.meta.url);
-var pluginsDoctor = defineSystemCommand({
-  name: "doctor",
-  description: "Diagnose plugin issues and suggest fixes",
-  category: "plugins",
-  examples: generateExamples("doctor", "plugins", [
-    { flags: {} },
-    // kb plugins doctor
-    { flags: { json: true } }
-    // kb plugins doctor --json
-  ]),
-  flags: {
-    json: { type: "boolean", description: "Output in JSON format" }
-  },
-  analytics: {
-    command: "plugins:doctor",
-    startEvent: "PLUGINS_DOCTOR_STARTED",
-    finishEvent: "PLUGINS_DOCTOR_FINISHED"
-  },
-  async handler(ctx, argv, _flags) {
-    const targetPlugin = argv[0];
-    const cwd = getContextCwd(ctx);
-    const manifests = registry.listManifests();
-    const issues = [];
-    for (const cmd of manifests) {
-      const pkgName = cmd.manifest.package || cmd.manifest.group || "";
-      if (!pkgName) {
-        continue;
-      }
-      if (targetPlugin && !pkgName.includes(targetPlugin)) {
-        continue;
-      }
-      if (cmd.manifest.engine?.node) {
-        const required = cmd.manifest.engine.node;
-        const current = process.version;
-        if (required.startsWith(">=")) {
-          const requiredVersion = required.replace(">=", "").trim();
-          const currentVersionParts = current.split(".");
-          const requiredVersionParts = requiredVersion.split(".");
-          if (currentVersionParts[0] && requiredVersionParts[0]) {
-            const currentMajor = parseInt(currentVersionParts[0].replace("v", ""), 10);
-            const requiredMajor = parseInt(requiredVersionParts[0], 10);
-            if (!isNaN(currentMajor) && !isNaN(requiredMajor) && currentMajor < requiredMajor) {
-              issues.push({
-                package: pkgName,
-                severity: "error",
-                code: "NODE_VERSION_MISMATCH",
-                message: `Requires Node ${required}, found ${current}`,
-                fix: `Upgrade Node to ${required} or higher`
-              });
-            }
-          }
-        }
-      }
-      if (cmd.manifest.engine?.kbCli) {
-        const required = cmd.manifest.engine.kbCli;
-        const current = process.env.CLI_VERSION || process.env.CLI_VERSION || "0.1.0";
-        if (required.startsWith("^") && current !== "0.1.0") {
-          const requiredParts = required.replace("^", "").split(".");
-          const currentParts = current.split(".");
-          if (requiredParts[0] && currentParts[0]) {
-            const requiredMajor = parseInt(requiredParts[0], 10);
-            const currentMajor = parseInt(currentParts[0], 10);
-            if (!isNaN(requiredMajor) && !isNaN(currentMajor) && currentMajor < requiredMajor) {
-              issues.push({
-                package: pkgName,
-                severity: "error",
-                code: "CLI_VERSION_MISMATCH",
-                message: `Requires kb-cli ${required}, found ${current}`,
-                fix: `Upgrade kb-cli: pnpm -w update @kb-labs/cli`
-              });
-            }
-          }
-        }
-      }
-      if (cmd.manifest.requires) {
-        for (const req2 of cmd.manifest.requires) {
-          const parts = req2.split("@");
-          const pkgNameReq = parts[0];
-          if (!pkgNameReq) {
-            continue;
-          }
-          try {
-            require2.resolve(pkgNameReq);
-          } catch {
-            issues.push({
-              package: pkgName,
-              severity: "error",
-              code: "MISSING_PEER_DEP",
-              message: `Missing peer dependency: ${req2}`,
-              fix: `Install: pnpm add ${req2}`
-            });
-          }
-        }
-      }
-      if (cmd.manifest.engine?.module) {
-        const required = cmd.manifest.engine.module;
-        const pkgJsonPath = path2.join(cmd.pkgRoot || cwd, "package.json");
-        try {
-          const pkgJson = JSON.parse(await promises.readFile(pkgJsonPath, "utf8"));
-          const isESM = pkgJson.type === "module";
-          if (required === "esm" && !isESM) {
-            issues.push({
-              package: pkgName,
-              severity: "warning",
-              code: "MODULE_TYPE_MISMATCH",
-              message: `Plugin declares ESM but package.json doesn't have "type": "module"`,
-              fix: `Add "type": "module" to ${pkgName}/package.json`
-            });
-          } else if (required === "cjs" && isESM) {
-            issues.push({
-              package: pkgName,
-              severity: "warning",
-              code: "MODULE_TYPE_MISMATCH",
-              message: `Plugin declares CJS but package.json has "type": "module"`,
-              fix: `Remove "type": "module" from ${pkgName}/package.json or use .cjs extension`
-            });
-          }
-        } catch {
-        }
-      }
-      if (!cmd.available && cmd.unavailableReason) {
-        issues.push({
-          package: pkgName,
-          severity: "error",
-          code: "UNAVAILABLE",
-          message: cmd.unavailableReason,
-          fix: cmd.hint || "Check dependencies and manifest"
-        });
-      }
-    }
-    const summary = {
-      total: issues.length,
-      errors: issues.filter((i) => i.severity === "error").length,
-      warnings: issues.filter((i) => i.severity === "warning").length,
-      info: issues.filter((i) => i.severity === "info").length
-    };
-    ctx.platform?.logger?.info("Plugins doctor completed", summary);
-    return {
-      ok: summary.errors === 0,
-      issues,
-      summary
-    };
-  },
-  formatter(result, ctx, flags) {
-    const resultData = result;
-    if (flags.json) {
-      ctx.ui.json(resultData);
-      return;
-    }
-    const { issues, summary } = resultData;
-    if (issues.length === 0) {
-      ctx.ui.info(`${ctx.ui.symbols.success} All plugins are healthy!`);
-      return;
-    }
-    const errorCount = summary.errors;
-    const warningCount = summary.warnings;
-    const summaryItems = [
-      `Total Issues: ${issues.length}`,
-      `Errors: ${errorCount > 0 ? ctx.ui.colors.error(errorCount.toString()) : "none"}`,
-      `Warnings: ${warningCount > 0 ? ctx.ui.colors.warning(warningCount.toString()) : "none"}`
-    ];
-    const issueItems = [];
-    const byPackage = /* @__PURE__ */ new Map();
-    for (const issue of issues) {
-      if (!byPackage.has(issue.package)) {
-        byPackage.set(issue.package, []);
-      }
-      byPackage.get(issue.package).push(issue);
-    }
-    for (const [pkg, pkgIssues] of Array.from(byPackage.entries()).sort()) {
-      issueItems.push(ctx.ui.colors.bold(`${pkg}:`));
-      for (const issue of pkgIssues) {
-        const icon = issue.severity === "error" ? ctx.ui.symbols.error : ctx.ui.symbols.warning;
-        const color = issue.severity === "error" ? ctx.ui.colors.error : ctx.ui.colors.warning;
-        issueItems.push(`  ${icon} ${color(issue.code)}: ${issue.message}`);
-        if (issue.fix) {
-          issueItems.push(`     ${ctx.ui.colors.info(`Fix: ${issue.fix}`)}`);
+          header: "Next Steps",
+          items: nextSteps
         }
+      ];
+      if (hasErrors) {
+        ctx.ui.error("System Diagnostics", { sections });
+      } else if (hasWarnings) {
+        ctx.ui.warn("System Diagnostics", { sections });
+      } else {
+        ctx.ui.success("System Diagnostics", { sections });
       }
     }
-    const nextStepsItems = [
-      `kb plugins enable <name>  ${ctx.ui.colors.muted("Enable a disabled plugin")}`,
-      `kb plugins clear-cache  ${ctx.ui.colors.muted("Clear cache and rediscover")}`
-    ];
-    const sections = [
-      {
-        header: "Summary",
-        items: summaryItems
-      },
-      {
-        header: "Issues",
-        items: issueItems
-      },
-      {
-        header: "Next Steps",
-        items: nextStepsItems
-      }
-    ];
-    if (errorCount > 0) {
-      ctx.ui.error("Plugin Diagnostics", { sections });
-    } else if (warningCount > 0) {
-      ctx.ui.warn("Plugin Diagnostics", { sections });
-    } else {
-      ctx.ui.success("Plugin Diagnostics", { sections });
-    }
   }
 });
-var pluginsScaffold = defineSystemCommand({
-  name: "scaffold",
-  description: "Generate a new KB CLI plugin template",
-  category: "plugins",
-  examples: generateExamples("scaffold", "plugins", [
-    { flags: {} },
-    // kb plugins scaffold (requires <name> arg)
-    { flags: { format: "cjs" } }
-  ]),
+var registryDiagnostics = defineSystemCommand({
+  name: "diagnostics",
+  description: "Show registry diagnostic report",
+  category: "registry",
+  examples: [],
   flags: {
-    format: {
-      type: "string",
-      description: "Module format: esm or cjs",
-      default: "esm",
-      choices: ["esm", "cjs"]
-    }
+    json: { type: "boolean", description: "Output in JSON format" },
+    refresh: { type: "boolean", description: "Force fresh discovery (ignore cache)" }
   },
   analytics: {
-    command: "plugins:scaffold",
-    startEvent: "PLUGINS_SCAFFOLD_STARTED",
-    finishEvent: "PLUGINS_SCAFFOLD_FINISHED"
-  },
-  async handler(ctx, argv, flags) {
-    if (argv.length === 0) {
-      throw new Error("Please specify a plugin name");
-    }
-    const pluginName = argv[0];
-    if (!pluginName) {
-      throw new Error("Please specify a plugin name");
-    }
-    ctx.platform?.logger?.info("Scaffolding plugin", { pluginName });
-    const format = String(flags.format ?? "esm");
-    const isESM = format === "esm";
-    const extension = isESM ? "ts" : "ts";
-    const moduleType = isESM ? "module" : "commonjs";
-    const tsupFormat = isESM ? "esm" : "cjs";
-    const baseDir = getContextCwd(ctx);
-    const dir = path2.join(baseDir, pluginName);
-    try {
-      await promises.access(dir);
-      ctx.platform?.logger?.warn("Directory already exists", { dir });
-      throw new Error(`Directory ${pluginName} already exists`);
-    } catch (err) {
-      if (err.code !== "ENOENT") {
-        throw err;
-      }
-    }
-    await promises.mkdir(dir, { recursive: true });
-    await promises.mkdir(path2.join(dir, "src"), { recursive: true });
-    await promises.mkdir(path2.join(dir, "src", "kb"), { recursive: true });
-    await promises.mkdir(path2.join(dir, "src", "commands"), { recursive: true });
-    const packageJson = {
-      name: `@your-scope/${pluginName}-cli`,
-      version: "1.0.0",
-      type: moduleType,
-      description: `KB Labs CLI plugin: ${pluginName}`,
-      keywords: ["kb-cli-plugin"],
-      main: `./dist/kb/manifest.js`,
-      exports: {
-        "./kb/manifest": "./dist/kb/manifest.js"
-      },
-      files: ["dist"],
-      scripts: {
-        build: `tsup src/kb/manifest.ts src/commands/hello.ts --format ${tsupFormat} --dts`,
-        dev: `tsup src/kb/manifest.ts src/commands/hello.ts --format ${tsupFormat} --watch`
-      },
-      kb: {
-        plugin: true,
-        manifest: "./dist/kb/manifest.js"
-      },
-      dependencies: {
-        "@kb-labs/plugin-manifest": "workspace:*",
-        "@kb-labs/shared-cli-ui": "workspace:*",
-        "@kb-labs/core-types": "workspace:*"
-      },
-      devDependencies: {
-        tsup: "^8.5.0",
-        typescript: "^5.6.3"
-      }
-    };
-    await promises.writeFile(path2.join(dir, "package.json"), JSON.stringify(packageJson, null, 2), "utf8");
-    const tsconfig = {
-      extends: "@kb-labs/devkit/tsconfig/lib.json",
-      compilerOptions: {
-        outDir: "dist",
-        rootDir: "src"
-      },
-      include: ["src/**/*"]
-    };
-    await promises.writeFile(path2.join(dir, "tsconfig.json"), JSON.stringify(tsconfig, null, 2), "utf8");
-    const manifestContent = `import type { ManifestV2 } from '@kb-labs/plugin-contracts';
-
-export const manifest: ManifestV2 = {
-  schema: 'kb.plugin/2',
-  id: '@your-scope/${pluginName}',
-  version: '0.1.0',
-  display: {
-    name: '${pluginName} Plugin',
-    description: 'Example KB Labs CLI plugin using manifest v2'
+    command: "registry:diagnostics",
+    startEvent: "REGISTRY_DIAGNOSTICS_STARTED",
+    finishEvent: "REGISTRY_DIAGNOSTICS_FINISHED"
   },
-  permissions: {
-    fs: {
-      mode: 'read',
-      allow: ['.']
-    },
-    env: {
-      allow: ['NODE_ENV']
+  async handler(ctx, _argv, flags) {
+    const cwd = getContextCwd(ctx);
+    const registry2 = await createRegistry({ root: cwd });
+    if (flags.refresh) {
+      await registry2.refresh();
     }
+    const report = registry2.getDiagnostics();
+    await registry2.dispose();
+    return { ok: report.summary.errors === 0, report };
   },
-  cli: {
-    commands: [
-      {
-        id: 'hello',
-        group: '${pluginName}',
-        describe: 'Hello command from ${pluginName}',
-        flags: [],
-        handler: './commands/hello#run'
-      }
-    ]
-  }
-};
-`;
-    await promises.writeFile(path2.join(dir, "src", "kb", `manifest.${extension}`), manifestContent, "utf8");
-    const commandContent = `import { defineCommand, type CommandResult } from '@kb-labs/shared-command-kit';
-
-// Define flag types for type safety
-type ${pluginName.charAt(0).toUpperCase() + pluginName.slice(1)}HelloFlags = {
-  json: { type: 'boolean'; description?: string; default?: boolean };
-  quiet: { type: 'boolean'; description?: string; default?: boolean };
-};
-
-// Define result type for type safety
-type ${pluginName.charAt(0).toUpperCase() + pluginName.slice(1)}HelloResult = CommandResult & {
-  count?: number;
-  message?: string;
-  timing?: number;
-};
-
-export const run = defineCommand<${pluginName.charAt(0).toUpperCase() + pluginName.slice(1)}HelloFlags, ${pluginName.charAt(0).toUpperCase() + pluginName.slice(1)}HelloResult>({
-  name: '${pluginName}:hello',
-  flags: {
-    json: {
-      type: 'boolean',
-      description: 'Output as JSON',
-      default: false,
-    },
-    quiet: {
-      type: 'boolean',
-      description: 'Suppress non-error output',
-      default: false,
-    },
-  },
-  async handler(ctx, argv, flags) {
-    // Full type safety: flags.json and flags.quiet are properly typed!
-    ctx.platform?.logger?.info('${pluginName} hello started');
-
-
-    // Your command logic here
-    const result = { 
-      count: 1, 
-      message: 'Hello from ${pluginName} plugin!' 
-    };
-
-    const duration = ctx.tracker.total();
-
-    ctx.platform?.logger?.info('${pluginName} hello completed', {
-      durationMs: duration,
-    });
-
+  formatter(result, ctx, flags) {
     if (flags.json) {
-      ctx.ui.json({ ok: true, ...result, timing: duration });
-    } else if (!flags.quiet) {
-      const summary = [
-        ctx.ui.colors.success('\u2713 Success'),
-        \`Message: \${result.message}\`,
-        \`Time: \${ctx.ui.colors.muted(duration + 'ms')}\`,
-      ];
-      ctx.ui.write(ctx.ui.box('${pluginName} Command', summary));
+      ctx.ui.info(JSON.stringify(result.report, null, 2));
+      return;
+    }
+    const text = formatDiagnosticReport(result.report);
+    ctx.ui.info(text);
+    if (result.report.summary.errors > 0) {
+      ctx.ui.error(`${result.report.summary.errors} error(s) found \u2014 see details above`);
+    } else if (result.report.summary.warnings > 0) {
+      ctx.ui.warn(`${result.report.summary.warnings} warning(s) \u2014 no blockers`);
+    } else {
+      ctx.ui.success("Registry is healthy \u2014 no issues found");
     }
-
-    return { ok: true, ...result, timing: duration };
-  },
-});
-
-// Alternative: Level 2 - Partial typing (flags only)
-// Remove the result type parameter to use partial typing:
-// export const run = defineCommand<${pluginName.charAt(0).toUpperCase() + pluginName.slice(1)}HelloFlags>({ ... });
-
-// Alternative: Level 1 - No typing (minimal)
-// Remove both type parameters for quick prototyping:
-// export const run = defineCommand({ ... });
-`;
-    await promises.writeFile(path2.join(dir, "src", "commands", `hello.${extension}`), commandContent, "utf8");
-    const tsupConfig = `import config from "@kb-labs/devkit/tsup/node.js";
-
-export default {
-  ...config,
-  entry: ['src/kb/manifest.ts', 'src/commands/hello.ts'],
-  format: ['${tsupFormat}'],
-  dts: true,
-};
-`;
-    await promises.writeFile(path2.join(dir, "tsup.config.ts"), tsupConfig, "utf8");
-    const readme = `# ${pluginName} CLI Plugin
-
-KB Labs CLI plugin for ${pluginName}.
-
-## Installation
-
-\`\`\`bash
-pnpm add @your-scope/${pluginName}-cli
-\`\`\`
-
-## Usage
-
-\`\`\`bash
-kb ${pluginName} hello
-\`\`\`
-
-## Development
-
-\`\`\`bash
-# Build
-pnpm build
-
-# Watch mode
-pnpm dev
-
-# Link for local development
-kb plugins link ./${pluginName}
-\`\`\`
-`;
-    await promises.writeFile(path2.join(dir, "README.md"), readme, "utf8");
-    const gitignore = `node_modules
-dist
-*.log
-.DS_Store
-`;
-    await promises.writeFile(path2.join(dir, ".gitignore"), gitignore, "utf8");
-    ctx.platform?.logger?.info("Plugin scaffold created", { pluginName, dir });
-    return {
-      ok: true,
-      pluginName,
-      dir
-    };
-  },
-  formatter(result, ctx, _flags) {
-    const resultData = result;
-    const { pluginName, dir } = resultData;
-    const sections = [
-      {
-        items: [
-          ctx.ui.colors.bold("Plugin Template Created:"),
-          `${ctx.ui.symbols.success} ${ctx.ui.colors.info(dir)}`,
-          "",
-          ctx.ui.colors.bold("Next Steps:"),
-          `  ${ctx.ui.colors.info(`cd ${pluginName}`)}`,
-          `  ${ctx.ui.colors.info("pnpm install")}`,
-          `  ${ctx.ui.colors.info("pnpm build")}`,
-          `  ${ctx.ui.colors.info(`kb plugins link ./${pluginName}`)}`,
-          `  ${ctx.ui.colors.info(`kb ${pluginName} hello`)}`,
-          "",
-          ctx.ui.colors.muted("See docs/plugin-development.md for more details")
-        ]
-      }
-    ];
-    ctx.ui.success("Plugin Scaffold", { sections });
   }
 });
-async function validateManifestAgainstContracts(manifest, contractsPath) {
+async function clearCache(cwd, options) {
+  const cleared = [];
+  const cacheDir = path.join(cwd, ".kb", "cache");
   try {
-    const contractsModule = await import(path2.resolve(contractsPath));
-    const contracts = contractsModule.pluginContractsManifest || contractsModule.default;
-    if (!contracts) {
-      return { ok: false, issues: ["Contracts file does not export pluginContractsManifest"] };
-    }
-    const issues = [];
-    if (typeof manifest === "object" && manifest !== null && "artifacts" in manifest) {
-      const manifestArtifacts = manifest.artifacts || [];
-      const contractArtifacts = contracts.artifacts || {};
-      for (const artifact of manifestArtifacts) {
-        if (!(artifact.id in contractArtifacts)) {
-          issues.push(`Artifact ID "${artifact.id}" not found in contracts`);
-        }
-      }
-    }
-    if (typeof manifest === "object" && manifest !== null && "cli" in manifest) {
-      const cli = manifest.cli;
-      const manifestCommands = cli?.commands || [];
-      const contractCommands = contracts.commands || {};
-      for (const cmd of manifestCommands) {
-        if (!(cmd.id in contractCommands)) {
-          issues.push(`Command ID "${cmd.id}" not found in contracts`);
-        }
+    const entries = await promises.readdir(cacheDir);
+    for (const entry of entries) {
+      if (entry.includes("manifest") || entry.includes("plugin")) {
+        const entryPath = path.join(cacheDir, entry);
+        await promises.unlink(entryPath);
+        cleared.push(entry);
       }
     }
-    return { ok: issues.length === 0, issues };
-  } catch (error) {
-    return {
-      ok: false,
-      issues: [`Failed to load contracts: ${error instanceof Error ? error.message : String(error)}`]
-    };
+  } catch {
   }
-}
-var pluginValidate = defineSystemCommand({
-  name: "plugin:validate",
-  description: "Validate plugin manifest and contracts",
-  category: "plugins",
-  flags: {
-    manifest: {
-      type: "string",
-      description: "Path to manifest file (default: manifest.v2.ts)",
-      default: "manifest.v2.ts"
-    },
-    contracts: {
-      type: "string",
-      description: "Path to contracts file for cross-validation"
-    },
-    fix: {
-      type: "boolean",
-      description: "Automatically fix common issues"
-    }
-  },
-  async handler(ctx, argv, flags) {
-    const cwd = getContextCwd(ctx);
-    const manifestPath = path2.resolve(cwd, flags.manifest || "manifest.v2.ts");
-    ctx.ui.write(`Validating manifest: ${manifestPath}
-`);
-    let manifestContent;
-    try {
-      manifestContent = await promises.readFile(manifestPath, "utf-8");
-    } catch (error) {
-      ctx.ui.error(`Failed to read manifest: ${error instanceof Error ? error.message : String(error)}
-`);
-      return { ok: false };
+  const manifestsCachePath = path.join(cwd, ".kb", "marketplace.manifests.json");
+  try {
+    await promises.unlink(manifestsCachePath);
+    cleared.push("marketplace.manifests.json");
+  } catch {
+  }
+  const cliManifestsPath = path.join(cwd, ".kb", "cache", "cli-manifests.json");
+  try {
+    await promises.unlink(cliManifestsPath);
+    if (!cleared.includes("cli-manifests.json")) {
+      cleared.push("cli-manifests.json");
     }
-    let manifest;
+  } catch {
+  }
+  const modulesCleared = [];
+  if (options?.deep) {
     try {
-      const modulePath = manifestPath.replace(/\.ts$/, "");
-      const manifestModule = await import(modulePath);
-      manifest = manifestModule.manifest || manifestModule.default;
-    } catch (error) {
-      try {
-        manifest = JSON.parse(manifestContent);
-      } catch (_jsonError) {
-        ctx.ui.error(`Failed to parse manifest: ${error instanceof Error ? error.message : String(error)}
-`);
-        return { ok: false };
-      }
-    }
-    const validationResult = validateManifest(manifest);
-    if (!validationResult.valid) {
-      ctx.ui.error("\u274C Manifest validation failed:\n");
-      for (const msg of validationResult.errors) {
-        ctx.ui.write(`  - ${msg}
-`);
-      }
-      return { ok: false, valid: false, errors: validationResult.errors.map((msg) => ({ path: "", message: msg })) };
-    }
-    ctx.ui.success("\u2705 Manifest structure is valid!\n");
-    if (flags.contracts) {
-      const contractsPath = path2.resolve(cwd, flags.contracts);
-      ctx.ui.write(`
-Validating against contracts: ${contractsPath}
-`);
-      const crossValidation = await validateManifestAgainstContracts(manifest, contractsPath);
-      if (!crossValidation.ok) {
-        ctx.ui.error("\u274C Manifest does not match contracts:\n");
-        for (const issue of crossValidation.issues) {
-          ctx.ui.write(`  - ${issue}
-`);
+      const cache = __require.cache;
+      for (const key in cache) {
+        if (key.includes("plugin") || key.includes("manifest") || key.includes("@kb-labs")) {
+          delete cache[key];
+          modulesCleared.push(key);
         }
-        return { ok: false, valid: false, errors: crossValidation.issues.map((issue) => ({
-          path: "",
-          message: issue
-        })) };
       }
-      ctx.ui.success("\u2705 Manifest matches contracts!\n");
+    } catch {
     }
-    ctx.ui.success("\n\u2705 All validations passed!\n");
-    return { ok: true, valid: true };
   }
-});
-
-// src/builtins/plugins-cache-clear.ts
-init_plugins_state();
+  return {
+    files: cleared,
+    ...options?.deep ? { modules: modulesCleared } : {}
+  };
+}
 var pluginsCacheClear = defineSystemCommand({
   name: "clear-cache",
   description: "Clear CLI plugin discovery cache",
-  category: "plugins",
-  examples: ["kb plugins clear-cache", "kb plugins clear-cache --deep"],
+  category: "marketplace",
+  examples: ["kb marketplace clear-cache", "kb marketplace clear-cache --deep"],
   flags: {
     deep: { type: "boolean", description: "Also clear Node.js module cache" },
     json: { type: "boolean", description: "Output in JSON format" }
   },
   analytics: {
-    command: "plugins:clear-cache",
-    startEvent: "PLUGINS_CACHE_CLEAR_STARTED",
-    finishEvent: "PLUGINS_CACHE_CLEAR_FINISHED"
+    command: "marketplace:clear-cache",
+    startEvent: "MARKETPLACE_CACHE_CLEAR_STARTED",
+    finishEvent: "MARKETPLACE_CACHE_CLEAR_FINISHED"
   },
   async handler(ctx, _argv, flags) {
     const deep = flags.deep;
@@ -3630,7 +1902,7 @@ var docsGenerateCliReference = defineSystemCommand({
   // eslint-disable-next-line sonarjs/cognitive-complexity -- Complex markdown generation with nested loops for product groups, commands, and formatting
   async handler(ctx, argv, flags) {
     const cwd = getContextCwd(ctx);
-    const outputPath = flags.output || path2.join(cwd, "CLI-REFERENCE.md");
+    const outputPath = flags.output || path.join(cwd, "CLI-REFERENCE.md");
     const commands = registry.list();
     const productGroups = registry.listProductGroups();
     ctx.platform?.logger?.info("Generating CLI reference", {
@@ -4622,6 +2894,252 @@ var logsStats = defineSystemCommand({
     ctx.ui.success("Log Storage Statistics", { sections });
   }
 });
+var authLogin = defineSystemCommand({
+  name: "login",
+  description: "Authenticate CLI with Gateway",
+  longDescription: 'Exchange client credentials for JWT tokens and save to ~/.kb/credentials.json. Tokens auto-refresh on expiry. Use "kb auth create-service-account" to create credentials first.',
+  category: "auth",
+  examples: [
+    "kb auth login --gateway-url http://localhost:4000 --client-id clt_xxx --client-secret cs_xxx",
+    "kb auth login --gateway-url https://gateway.example.com --client-id clt_xxx --client-secret cs_xxx --json"
+  ],
+  flags: {
+    "gateway-url": { type: "string", description: "Gateway server URL (e.g. http://localhost:4000)" },
+    "client-id": { type: "string", description: "Client ID from service account registration" },
+    "client-secret": { type: "string", description: "Client Secret from service account registration" },
+    json: { type: "boolean", description: "Output in JSON format" }
+  },
+  async handler(ctx, _argv, flags) {
+    const gatewayUrl = flags["gateway-url"];
+    const clientId = flags["client-id"];
+    const clientSecret = flags["client-secret"];
+    if (!gatewayUrl || !clientId || !clientSecret) {
+      const msg = "All flags required: --gateway-url, --client-id, --client-secret";
+      if (flags.json) {
+        ctx.ui?.json({ ok: false, error: msg });
+      } else {
+        ctx.ui?.error?.(msg);
+      }
+      return { ok: false, error: msg, gatewayUrl: "", expiresIn: 0 };
+    }
+    const tokenUrl = `${gatewayUrl}/auth/token`;
+    let tokenResponse;
+    try {
+      tokenResponse = await fetch(tokenUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ clientId, clientSecret })
+      });
+    } catch (err) {
+      const msg = `Cannot reach Gateway at ${gatewayUrl}: ${err instanceof Error ? err.message : String(err)}`;
+      if (flags.json) {
+        ctx.ui?.json({ ok: false, error: msg });
+      } else {
+        ctx.ui?.error?.(msg);
+      }
+      return { ok: false, error: msg, gatewayUrl, expiresIn: 0 };
+    }
+    if (!tokenResponse.ok) {
+      const body = await tokenResponse.text().catch(() => "");
+      const msg = `Authentication failed (HTTP ${tokenResponse.status}): ${body}`;
+      if (flags.json) {
+        ctx.ui?.json({ ok: false, error: msg });
+      } else {
+        ctx.ui?.error?.(msg);
+      }
+      return { ok: false, error: msg, gatewayUrl, expiresIn: 0 };
+    }
+    const tokenData = await tokenResponse.json();
+    const credentialsManager = new CredentialsManager();
+    const expiresAt = Date.now() + tokenData.expiresIn * 1e3;
+    await credentialsManager.save({
+      gatewayUrl,
+      accessToken: tokenData.accessToken,
+      refreshToken: tokenData.refreshToken,
+      expiresAt
+    });
+    if (flags.json) {
+      ctx.ui?.json({
+        ok: true,
+        gatewayUrl,
+        expiresIn: tokenData.expiresIn
+      });
+    } else {
+      ctx.ui?.write?.(`Authenticated with Gateway at ${gatewayUrl}
+`);
+      ctx.ui?.write?.(`Token expires in ${Math.floor(tokenData.expiresIn / 60)} minutes (auto-refresh enabled).
+`);
+    }
+    return { ok: true, gatewayUrl, expiresIn: tokenData.expiresIn };
+  }
+});
+var authLogout = defineSystemCommand({
+  name: "logout",
+  description: "Remove stored Gateway credentials",
+  longDescription: "Deletes ~/.kb/credentials.json. CLI will no longer be able to reach Gateway until re-login.",
+  category: "auth",
+  examples: [
+    "kb auth logout",
+    "kb auth logout --json"
+  ],
+  flags: {
+    json: { type: "boolean", description: "Output in JSON format" }
+  },
+  async handler(ctx, _argv, flags) {
+    const credentialsManager = new CredentialsManager();
+    const existing = await credentialsManager.load();
+    if (!existing) {
+      if (flags.json) {
+        ctx.ui?.json({ ok: true, message: "No credentials found \u2014 already logged out." });
+      } else {
+        ctx.ui?.write?.("No credentials found \u2014 already logged out.\n");
+      }
+      return { ok: true };
+    }
+    await credentialsManager.clear();
+    if (flags.json) {
+      ctx.ui?.json({ ok: true, message: "Logged out. Credentials removed." });
+    } else {
+      ctx.ui?.write?.("Logged out. Credentials removed.\n");
+    }
+    return { ok: true };
+  }
+});
+var authStatus = defineSystemCommand({
+  name: "status",
+  description: "Show Gateway authentication status",
+  longDescription: "Displays current credentials, token expiry, and Gateway URL. Optionally pings the Gateway to verify connectivity.",
+  category: "auth",
+  examples: [
+    "kb auth status",
+    "kb auth status --json"
+  ],
+  flags: {
+    json: { type: "boolean", description: "Output in JSON format" }
+  },
+  async handler(ctx, _argv, flags) {
+    const credentialsManager = new CredentialsManager();
+    const credentials = await credentialsManager.load();
+    if (!credentials) {
+      if (flags.json) {
+        ctx.ui?.json({ ok: true, authenticated: false });
+      } else {
+        ctx.ui?.write?.('Not authenticated. Run "kb auth login" to configure Gateway connection.\n');
+      }
+      return { ok: true, authenticated: false };
+    }
+    const expired = credentialsManager.isExpired(credentials);
+    const expiresAt = new Date(credentials.expiresAt).toISOString();
+    const timeLeft = credentials.expiresAt - Date.now();
+    const minutesLeft = Math.max(0, Math.floor(timeLeft / 6e4));
+    if (flags.json) {
+      ctx.ui?.json({
+        ok: true,
+        authenticated: true,
+        gatewayUrl: credentials.gatewayUrl,
+        tokenExpired: expired,
+        expiresAt,
+        minutesLeft
+      });
+    } else {
+      ctx.ui?.write?.(`Gateway: ${credentials.gatewayUrl}
+`);
+      if (expired) {
+        ctx.ui?.write?.(`Token: expired (will auto-refresh on next request)
+`);
+      } else {
+        ctx.ui?.write?.(`Token: valid (expires in ${minutesLeft} min)
+`);
+      }
+    }
+    return {
+      ok: true,
+      authenticated: true,
+      gatewayUrl: credentials.gatewayUrl,
+      tokenExpired: expired,
+      expiresAt
+    };
+  }
+});
+var authCreateServiceAccount = defineSystemCommand({
+  name: "create-service-account",
+  description: "Register a new service account with Gateway",
+  longDescription: 'Creates a new client registration in Gateway and returns clientId + clientSecret. Use these credentials with "kb auth login" to authenticate.',
+  category: "auth",
+  examples: [
+    "kb auth create-service-account --gateway-url http://localhost:4000 --name my-cli --namespace-id default",
+    "kb auth create-service-account --gateway-url http://localhost:4000 --name ci-agent --namespace-id default --json"
+  ],
+  flags: {
+    "gateway-url": { type: "string", description: "Gateway server URL" },
+    name: { type: "string", description: "Service account name (1-64 chars)" },
+    "namespace-id": { type: "string", description: "Namespace ID (1-64 chars)" },
+    json: { type: "boolean", description: "Output in JSON format" }
+  },
+  async handler(ctx, _argv, flags) {
+    const gatewayUrl = flags["gateway-url"];
+    const name = flags.name;
+    const namespaceId = flags["namespace-id"];
+    if (!gatewayUrl || !name || !namespaceId) {
+      const msg = "All flags required: --gateway-url, --name, --namespace-id";
+      if (flags.json) {
+        ctx.ui?.json({ ok: false, error: msg });
+      } else {
+        ctx.ui?.error?.(msg);
+      }
+      return { ok: false, error: msg };
+    }
+    let response;
+    try {
+      response = await fetch(`${gatewayUrl}/auth/register`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ name, namespaceId })
+      });
+    } catch (err) {
+      const msg = `Cannot reach Gateway at ${gatewayUrl}: ${err instanceof Error ? err.message : String(err)}`;
+      if (flags.json) {
+        ctx.ui?.json({ ok: false, error: msg });
+      } else {
+        ctx.ui?.error?.(msg);
+      }
+      return { ok: false, error: msg };
+    }
+    if (!response.ok) {
+      const body = await response.text().catch(() => "");
+      const msg = `Registration failed (HTTP ${response.status}): ${body}`;
+      if (flags.json) {
+        ctx.ui?.json({ ok: false, error: msg });
+      } else {
+        ctx.ui?.error?.(msg);
+      }
+      return { ok: false, error: msg };
+    }
+    const data = await response.json();
+    if (flags.json) {
+      ctx.ui?.json({
+        ok: true,
+        clientId: data.clientId,
+        clientSecret: data.clientSecret,
+        hostId: data.hostId
+      });
+    } else {
+      ctx.ui?.write?.("Service account created successfully.\n\n");
+      ctx.ui?.write?.(`  Client ID:     ${data.clientId}
+`);
+      ctx.ui?.write?.(`  Client Secret: ${data.clientSecret}
+`);
+      ctx.ui?.write?.(`  Host ID:       ${data.hostId}
+
+`);
+      ctx.ui?.write?.("Save these credentials securely \u2014 the secret is shown only once.\n\n");
+      ctx.ui?.write?.("To authenticate:\n");
+      ctx.ui?.write?.(`  kb auth login --gateway-url ${gatewayUrl} --client-id ${data.clientId} --client-secret ${data.clientSecret}
+`);
+    }
+    return { ok: true, clientId: data.clientId, clientSecret: data.clientSecret, hostId: data.hostId };
+  }
+});
 
 // src/commands/system/groups.ts
 var infoGroup = defineSystemCommandGroup("info", "System information commands", [
@@ -4630,18 +3148,8 @@ var infoGroup = defineSystemCommandGroup("info", "System information commands",
   health,
   diag
 ]);
-var pluginsGroup = defineSystemCommandGroup("plugins", "Plugin management commands", [
-  pluginsList,
-  pluginsCommands,
-  pluginsEnable,
-  pluginsDisable,
-  pluginsLink,
-  pluginsUnlink,
-  pluginsCacheClear,
-  pluginsRegistry,
-  pluginsDoctor,
-  pluginsScaffold,
-  pluginValidate
+var marketplaceGroup = defineSystemCommandGroup("marketplace", "Marketplace management commands", [
+  pluginsCacheClear
 ]);
 var docsGroup = defineSystemCommandGroup("docs", "Documentation generation commands", [
   docsGenerateCliReference
@@ -4655,17 +3163,26 @@ var logsGroup = defineSystemCommandGroup("logs", "Log viewing and analysis comma
   logsGet,
   logsStats
 ]);
+var registryGroup = defineSystemCommandGroup("registry", "Entity registry commands", [
+  registryDiagnostics
+]);
+var authGroup = defineSystemCommandGroup("auth", "Gateway authentication commands", [
+  authLogin,
+  authLogout,
+  authStatus,
+  authCreateServiceAccount
+]);
 var req = createRequire(import.meta.url);
 var __filename$1 = fileURLToPath(import.meta.url);
-var __dirname$1 = path2.dirname(__filename$1);
+var __dirname$1 = path.dirname(__filename$1);
 function resolveFromCwd(spec, cwd) {
-  const cliRoot = path2.resolve(__dirname$1, "../../..");
+  const cliRoot = path.resolve(__dirname$1, "../../..");
   let monorepoRoot = cwd;
-  while (monorepoRoot !== path2.dirname(monorepoRoot)) {
-    if (existsSync(path2.join(monorepoRoot, "pnpm-workspace.yaml"))) {
+  while (monorepoRoot !== path.dirname(monorepoRoot)) {
+    if (existsSync(path.join(monorepoRoot, "pnpm-workspace.yaml"))) {
       break;
     }
-    monorepoRoot = path2.dirname(monorepoRoot);
+    monorepoRoot = path.dirname(monorepoRoot);
   }
   const pathsToTry = [
     cwd,
@@ -4674,9 +3191,9 @@ function resolveFromCwd(spec, cwd) {
     // CLI installation directory
     monorepoRoot,
     // Monorepo root (if found)
-    path2.join(monorepoRoot, "../kb-labs-cli"),
+    path.join(monorepoRoot, "../kb-labs-cli"),
     // Explicit kb-labs-cli path
-    path2.join(monorepoRoot, "../kb-labs-mind")
+    path.join(monorepoRoot, "../kb-labs-mind")
     // Explicit kb-labs-mind path
   ].filter(Boolean);
   for (const searchPath of pathsToTry) {
@@ -4694,12 +3211,12 @@ function checkRequires(manifest, options = {}) {
   }
   let isInMonorepo = false;
   let monorepoRoot = cwd;
-  while (monorepoRoot !== path2.dirname(monorepoRoot)) {
-    if (existsSync(path2.join(monorepoRoot, "pnpm-workspace.yaml"))) {
+  while (monorepoRoot !== path.dirname(monorepoRoot)) {
+    if (existsSync(path.join(monorepoRoot, "pnpm-workspace.yaml"))) {
       isInMonorepo = true;
       break;
     }
-    monorepoRoot = path2.dirname(monorepoRoot);
+    monorepoRoot = path.dirname(monorepoRoot);
   }
   for (const dep of manifest.requires) {
     try {
@@ -4723,8 +3240,8 @@ function checkRequires(manifest, options = {}) {
         if (!packageName) {
           continue;
         }
-        const cliRoot = path2.resolve(__dirname$1, "../../..");
-        const packagePath = scope ? path2.join(cliRoot, "node_modules", "@" + scope, packageName, "package.json") : path2.join(cliRoot, "node_modules", packageName, "package.json");
+        const cliRoot = path.resolve(__dirname$1, "../../..");
+        const packagePath = scope ? path.join(cliRoot, "node_modules", "@" + scope, packageName, "package.json") : path.join(cliRoot, "node_modules", packageName, "package.json");
         if (existsSync(packagePath)) {
           continue;
         }
@@ -4777,7 +3294,7 @@ var manifestSchema = {
     examples: { type: "array", items: { type: "string" } }
   }
 };
-var validateManifest2 = ajv.compile(manifestSchema);
+var validateManifest = ajv.compile(manifestSchema);
 var validateFlag = ajv.compile(flagSchema);
 function validateFlagDef(flag, manifestId) {
   if (!validateFlag(flag)) {
@@ -4798,8 +3315,8 @@ function validateFlagDef(flag, manifestId) {
   }
 }
 function validateManifestStructure(manifest) {
-  if (!validateManifest2(manifest)) {
-    throw new Error(`Invalid manifest ${manifest.id}: ${ajv.errorsText(validateManifest2.errors)}`);
+  if (!validateManifest(manifest)) {
+    throw new Error(`Invalid manifest ${manifest.id}: ${ajv.errorsText(validateManifest.errors)}`);
   }
   if (manifest.manifestVersion !== "1.0") {
     throw new Error(
@@ -4830,7 +3347,7 @@ function generateWhitespaceAliases(id) {
   return [id.replace(":", " ")];
 }
 function normalizeAliases(manifest, logger) {
-  const log3 = logger ?? createNoOpLogger();
+  const log3 = logger ?? platform.logger;
   const aliases = /* @__PURE__ */ new Set();
   manifest.namespace || manifest.group;
   if (manifest.aliases) {
@@ -4877,7 +3394,7 @@ function checkCollision(manifest, existing, currentSource, namespace) {
   return { shouldShadow: false };
 }
 function preflightManifests(discoveryResults, logger) {
-  const log3 = logger ?? createNoOpLogger();
+  const log3 = logger ?? platform.logger;
   const valid = [];
   const skipped = [];
   for (const result of discoveryResults) {
@@ -4907,7 +3424,7 @@ function preflightManifests(discoveryResults, logger) {
   return { valid, skipped };
 }
 async function registerManifests(discoveryResults, registry2, options = {}) {
-  const log3 = options.logger ?? createNoOpLogger();
+  const log3 = options.logger ?? platform.logger;
   const registered = [];
   const skipped = [];
   const globalIds = /* @__PURE__ */ new Map();
@@ -5069,7 +3586,7 @@ async function registerManifests(discoveryResults, registry2, options = {}) {
   };
 }
 async function disposeAllPlugins(registry2, logger) {
-  const log3 = logger ?? createNoOpLogger();
+  const log3 = logger ?? platform.logger;
   const manifests = registry2.listManifests();
   const disposePromises = [];
   for (const cmd of manifests) {
@@ -5087,7 +3604,7 @@ async function disposeAllPlugins(registry2, logger) {
   }
   await Promise.allSettled(disposePromises);
 }
-var log2 = getLogger("cli:shutdown");
+var log2 = platform.logger.child({ module: "cli:shutdown" });
 var hooks = /* @__PURE__ */ new Set();
 var signalsBound = false;
 var exiting = false;
@@ -5125,7 +3642,7 @@ function registerShutdownHook(hook) {
 var _registered = false;
 var registeredCommands = [];
 async function registerBuiltinCommands(input = {}) {
-  const log3 = input.logger ?? createNoOpLogger();
+  const log3 = input.logger ?? platform.logger;
   if (_registered) {
     return;
   }
@@ -5133,9 +3650,11 @@ async function registerBuiltinCommands(input = {}) {
   registry.markPartial(true);
   registeredCommands.length = 0;
   registry.registerGroup(infoGroup);
-  registry.registerGroup(pluginsGroup);
+  registry.registerGroup(marketplaceGroup);
+  registry.registerGroup(registryGroup);
   registry.registerGroup(docsGroup);
   registry.registerGroup(logsGroup);
+  registry.registerGroup(authGroup);
   try {
     const cwd = getContextCwd({ cwd: input.cwd });
     const env = input.env ?? process.env;
@@ -5178,14 +3697,6 @@ async function registerBuiltinCommands(input = {}) {
     } else {
       registry.markPartial(false);
     }
-    const pluginRegistry = new PluginRegistry({
-      strategies: ["workspace", "pkg", "dir", "file"]
-    });
-    await pluginRegistry.refresh();
-    const plugins = pluginRegistry.list();
-    if (plugins.length > 0) {
-      log3.info(`Discovered ${plugins.length} plugins via cli-core`);
-    }
   } catch (err) {
     log3.warn(`Discovery failed: ${err.message}`);
     registry.markPartial(true);
@@ -5407,10 +3918,10 @@ function renderGlobalHelpNew(registry2) {
       )}  ${colors.dim("Explore product commands")}`
     );
   }
-  const pluginsGroup2 = systemGroups.find((g) => g.name === "system:plugins");
-  if (pluginsGroup2) {
+  const marketplaceGroup2 = systemGroups.find((g) => g.name === "marketplace");
+  if (marketplaceGroup2) {
     nextStepsItems.push(
-      `${colors.cyan("kb plugins")}  ${colors.dim("List and manage plugins")}`
+      `${colors.cyan("kb marketplace")}  ${colors.dim("Open marketplace commands")}`
     );
   }
   nextStepsItems.push("");
@@ -5430,19 +3941,20 @@ function renderGlobalHelpNew(registry2) {
 function renderPluginsHelp(registry2) {
   const tracker = new TimingTracker();
   registry2.list().filter(
-    (cmd) => cmd.name?.startsWith("plugins:") || cmd.category === "system"
+    (cmd) => cmd.name?.startsWith("marketplace:") || cmd.category === "system"
   );
   const sections = [];
   const commandMap = {
-    "plugins:ls": "List all discovered plugins",
-    "plugins:enable": "Enable a plugin",
-    "plugins:disable": "Disable a plugin",
-    "plugins:link": "Link a local plugin for development",
-    "plugins:unlink": "Unlink a local plugin",
-    "plugins:doctor": "Diagnose plugin issues",
-    "plugins:watch": "Watch for manifest changes and hot-reload",
-    "plugins:scaffold": "Generate a new plugin template",
-    "plugins:clear-cache": "Clear plugin discovery cache"
+    "marketplace:install": "Install package(s) from marketplace",
+    "marketplace:update": "Update package(s) from marketplace",
+    "marketplace:list": "List all discovered plugins",
+    "marketplace:enable": "Enable a plugin",
+    "marketplace:disable": "Disable a plugin",
+    "marketplace:link": "Link a local plugin for development",
+    "marketplace:unlink": "Unlink a local plugin",
+    "marketplace:doctor": "Diagnose plugin issues",
+    "marketplace:scaffold": "Generate a new plugin template",
+    "marketplace:clear-cache": "Clear plugin discovery cache"
   };
   const maxLength = Math.max(
     ...Object.keys(commandMap).map((c) => c.length),
@@ -5456,10 +3968,10 @@ function renderPluginsHelp(registry2) {
     items: commandItems
   });
   const examples = [
-    `kb plugins ls                      ${colors.dim("List all plugins")}`,
-    `kb plugins enable @kb-labs/devlink-cli  ${colors.dim("Enable a plugin")}`,
-    `kb plugins doctor                 ${colors.dim("Diagnose plugin issues")}`,
-    `kb plugins scaffold my-plugin      ${colors.dim("Generate plugin template")}`
+    `kb marketplace list                    ${colors.dim("List all plugins")}`,
+    `kb marketplace enable @kb-labs/devlink-cli  ${colors.dim("Enable a plugin")}`,
+    `kb marketplace doctor                 ${colors.dim("Diagnose plugin issues")}`,
+    `kb marketplace scaffold my-plugin      ${colors.dim("Generate plugin template")}`
   ];
   sections.push({
     header: "Examples",
@@ -5467,7 +3979,7 @@ function renderPluginsHelp(registry2) {
   });
   sections.push({
     header: "Next Steps",
-    items: [colors.dim("Use 'kb plugins <command> --help' for detailed help")]
+    items: [colors.dim("Use 'kb marketplace <command> --help' for detailed help")]
   });
   return sideBorderBox({
     title: "\u{1F9E9} Plugin Management",