@kb-labs/cli-commands 2.14.0 → 2.16.0

package/dist/{discover-BY7VE2Hf.d.ts → discover-Be0ez3AR.d.ts}

@@ -146,7 +146,8 @@ interface CommandLookupResult {
 }
 declare class InMemoryRegistry implements CommandRegistry {
     private systemCommands;
-    private pluginCommands;
+    private pluginByCanonical;
+    private pluginAliases;
     private byName;
     private groups;
     private manifests;
@@ -154,18 +155,45 @@ declare class InMemoryRegistry implements CommandRegistry {
     register(cmd: Command): void;
     registerGroup(group: CommandGroup): void;
     registerManifest(cmd: RegisteredCommand): void;
+    /**
+     * Check whether any system command already owns the canonical id or its parts.
+     * Returns the colliding key if found, null otherwise.
+     */
+    private _findSystemCollision;
+    /**
+     * Register all lookup aliases for a plugin command.
+     *
+     * Priority (what beats what) is handled in resolveToCanonical at query time.
+     * Here we just build the mapping.
+     *
+     * Aliases registered:
+     *   - canonicalId itself        ("marketplace:plugins:list")
+     *   - bare id                   ("list")         ← low priority, may clash
+     *   - 2-part shorthand          ("marketplace:list", "marketplace list")
+     *   - manifest.aliases[]        (user-defined aliases, except collisions)
+     */
+    private _registerPluginAliases;
+    /**
+     * Register synthetic subgroups for help display.
+     */
+    private _registerSyntheticGroups;
+    /**
+     * Resolve any user input to its canonical plugin ID.
+     *
+     * Returns canonicalId if found in plugin aliases, undefined otherwise.
+     */
+    private resolveToCanonical;
     markPartial(partial: boolean): void;
     isPartial(): boolean;
     getManifest(id: string): RegisteredCommand | undefined;
     listManifests(): RegisteredCommand[];
     has(name: string): boolean;
     /**
-     * Get command with type information for secure routing
-     *
-     * Returns type='system' for commands from registerGroup() - execute in-process
-     * Returns type='plugin' for commands from registerManifest() - execute in subprocess
+     * Get command with type information for secure routing.
      *
-     * This separation prevents malicious plugins from escaping the sandbox.
+     * System commands ALWAYS win — checked first before any plugin lookup.
+     * Returns type='system' for system commands (in-process execution).
+     * Returns type='plugin' for plugin commands (subprocess execution).
      */
     getWithType(nameOrPath: string | string[]): CommandLookupResult | undefined;
     get(nameOrPath: string | string[]): Command | CommandGroup | undefined;
@@ -180,11 +208,13 @@ declare class InMemoryRegistry implements CommandRegistry {
 declare const registry: InMemoryRegistry;
 declare function findCommand(nameOrPath: string | string[]): Command | CommandGroup | undefined;
 /**
- * Find command with type information for secure routing
+ * Find command with type information for secure routing.
  *
  * Use this in bootstrap.ts to determine execution path:
  * - type='system' → execute via cmd.run() in-process
  * - type='plugin' → execute via executePlugin() in plugin-executor
+ *
+ * System commands ALWAYS take priority over plugin commands.
  */
 declare function findCommandWithType(nameOrPath: string | string[]): CommandLookupResult | undefined;
 

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { C as CommandGroup, P as ProductGroup, a as Command, R as RegisteredCommand } from './discover-BY7VE2Hf.js';
-export { A as AvailabilityCheck, b as CacheFile, c as CommandLookupResult, d as CommandManifest, e as CommandModule, f as CommandType, D as DiscoveryResult, F as FlagDefinition, G as GlobalFlags, g as PackageCacheEntry, h as discoverManifests, i as discoverManifestsByNamespace, j as findCommand, k as findCommandWithType, r as registry } from './discover-BY7VE2Hf.js';
+import { C as CommandGroup, P as ProductGroup, a as Command, R as RegisteredCommand } from './discover-Be0ez3AR.js';
+export { A as AvailabilityCheck, b as CacheFile, c as CommandLookupResult, d as CommandManifest, e as CommandModule, f as CommandType, D as DiscoveryResult, F as FlagDefinition, G as GlobalFlags, g as PackageCacheEntry, h as discoverManifests, i as discoverManifestsByNamespace, j as findCommand, k as findCommandWithType, r as registry } from './discover-Be0ez3AR.js';
 import { ILogger } from '@kb-labs/core-platform';
 export { TimingTracker } from '@kb-labs/shared-cli-ui';
 import * as _kb_labs_shared_command_kit from '@kb-labs/shared-command-kit';

package/dist/index.js

@@ -1017,17 +1017,30 @@ function manifestToCommand(registered) {
     }
   };
 }
+function buildCanonicalId(manifest) {
+  const { id, group, subgroup } = manifest;
+  if (group && subgroup) {
+    return `${group}:${subgroup}:${id}`;
+  }
+  if (group) {
+    return `${group}:${id}`;
+  }
+  return id;
+}
 var InMemoryRegistry = class {
-  // Separate collections for security isolation
+  // System commands (in-process): key = any registered name/alias
   systemCommands = /* @__PURE__ */ new Map();
-  // System commands (in-process)
-  pluginCommands = /* @__PURE__ */ new Map();
-  // Plugin commands (subprocess)
-  // Legacy unified collection for backward compatibility
+  // Plugin commands: key = canonicalId only
+  pluginByCanonical = /* @__PURE__ */ new Map();
+  // Alias → canonicalId: covers all user-input variants that resolve to a plugin
+  pluginAliases = /* @__PURE__ */ new Map();
+  // Legacy unified collection for backward compatibility (display/get)
   byName = /* @__PURE__ */ new Map();
   groups = /* @__PURE__ */ new Map();
+  // manifests: any key → RegisteredCommand (for listing/lookup; still stores multi-key for compat)
   manifests = /* @__PURE__ */ new Map();
   partial = false;
+  // ─── System command registration ────────────────────────────────────────
   register(cmd) {
     this.systemCommands.set(cmd.name, cmd);
     this.byName.set(cmd.name, cmd);
@@ -1066,11 +1079,12 @@ var InMemoryRegistry = class {
       }
     }
   }
+  // ─── Plugin command registration ────────────────────────────────────────
   registerManifest(cmd) {
-    const cmdId = cmd.manifest.id;
-    const hasCollision = this.systemCommands.has(cmdId);
-    if (hasCollision) {
-      console.warn(`[registry] Plugin command "${cmdId}" collides with system command. System command takes priority.`);
+    const canonicalId = buildCanonicalId(cmd.manifest);
+    const collisionKey = this._findSystemCollision(cmd.manifest, canonicalId);
+    if (collisionKey) {
+      console.warn(`[registry] Plugin command "${canonicalId}" collides with system command "${collisionKey}". System command takes priority.`);
       cmd.shadowed = true;
     }
     const collisionAliases = /* @__PURE__ */ new Set();
@@ -1080,58 +1094,137 @@ var InMemoryRegistry = class {
         collisionAliases.add(alias);
       }
     }
-    this.pluginCommands.set(cmdId, cmd);
-    this.manifests.set(cmdId, cmd);
-    if (!hasCollision) {
-      const commandAdapter = manifestToCommand(cmd);
-      this.byName.set(cmdId, commandAdapter);
-      this.byName.set(commandAdapter.name, commandAdapter);
-      if (cmdId.includes(":")) {
-        const spaceSeparated = cmdId.replace(/:/g, " ");
-        this.byName.set(spaceSeparated, commandAdapter);
-      }
-      if (cmd.manifest.group && cmd.manifest.subgroup) {
-        const fullPath = `${cmd.manifest.group} ${cmd.manifest.subgroup} ${cmd.manifest.id}`;
-        const colonPath = `${cmd.manifest.group}:${cmd.manifest.subgroup}:${cmd.manifest.id}`;
-        this.byName.set(fullPath, commandAdapter);
-        this.byName.set(colonPath, commandAdapter);
-        this.manifests.set(fullPath, cmd);
-        this.manifests.set(colonPath, cmd);
-        this.pluginCommands.set(fullPath, cmd);
-        this.pluginCommands.set(colonPath, cmd);
-        const twoPartName = `${cmd.manifest.group} ${cmd.manifest.id}`;
-        if (!this.byName.has(twoPartName)) {
-          this.byName.set(twoPartName, commandAdapter);
-        }
-        const subgroupKey = `${cmd.manifest.group} ${cmd.manifest.subgroup}`;
-        if (!this.groups.has(subgroupKey)) {
-          this.groups.set(subgroupKey, {
-            name: subgroupKey,
-            describe: cmd.manifest.subgroup,
-            commands: []
-          });
-          this.byName.set(subgroupKey, this.groups.get(subgroupKey));
+    this.pluginByCanonical.set(canonicalId, cmd);
+    this.manifests.set(canonicalId, cmd);
+    this.manifests.set(cmd.manifest.id, cmd);
+    if (cmd.shadowed) {
+      return;
+    }
+    this._registerPluginAliases(cmd, canonicalId, collisionAliases);
+    const commandAdapter = manifestToCommand(cmd);
+    this.byName.set(canonicalId, commandAdapter);
+    const spaceCanonical = canonicalId.replace(/:/g, " ");
+    this.byName.set(spaceCanonical, commandAdapter);
+    this._registerSyntheticGroups(cmd, commandAdapter);
+  }
+  /**
+   * Check whether any system command already owns the canonical id or its parts.
+   * Returns the colliding key if found, null otherwise.
+   */
+  _findSystemCollision(manifest, canonicalId) {
+    if (this.systemCommands.has(canonicalId)) {
+      return canonicalId;
+    }
+    const space = canonicalId.replace(/:/g, " ");
+    if (this.systemCommands.has(space)) {
+      return space;
+    }
+    return null;
+  }
+  /**
+   * Register all lookup aliases for a plugin command.
+   *
+   * Priority (what beats what) is handled in resolveToCanonical at query time.
+   * Here we just build the mapping.
+   *
+   * Aliases registered:
+   *   - canonicalId itself        ("marketplace:plugins:list")
+   *   - bare id                   ("list")         ← low priority, may clash
+   *   - 2-part shorthand          ("marketplace:list", "marketplace list")
+   *   - manifest.aliases[]        (user-defined aliases, except collisions)
+   */
+  _registerPluginAliases(cmd, canonicalId, collisionAliases) {
+    const { id, group, subgroup } = cmd.manifest;
+    const register = (key) => {
+      if (!this.systemCommands.has(key) && !this.systemCommands.has(key.replace(/:/g, " "))) {
+        if (!this.pluginAliases.has(key)) {
+          this.pluginAliases.set(key, canonicalId);
+          this.manifests.set(key, cmd);
         }
-        this.groups.get(subgroupKey).commands.push(commandAdapter);
-      } else if (cmd.manifest.group) {
-        const fullName = `${cmd.manifest.group} ${cmd.manifest.id}`;
-        const colonName = `${cmd.manifest.group}:${cmd.manifest.id}`;
-        this.byName.set(fullName, commandAdapter);
-        this.byName.set(colonName, commandAdapter);
-        this.manifests.set(fullName, cmd);
-        this.manifests.set(colonName, cmd);
-        this.pluginCommands.set(fullName, cmd);
-        this.pluginCommands.set(colonName, cmd);
       }
-      if (cmd.manifest.aliases) {
-        for (const alias of cmd.manifest.aliases) {
-          if (!collisionAliases.has(alias)) {
-            this.byName.set(alias, commandAdapter);
-          }
-        }
+    };
+    this.pluginAliases.set(canonicalId, canonicalId);
+    const spaceCanonical = canonicalId.replace(/:/g, " ");
+    this.pluginAliases.set(spaceCanonical, canonicalId);
+    this.manifests.set(spaceCanonical, cmd);
+    if (group && subgroup) {
+      const twoPartColon = `${group}:${id}`;
+      const twoPartSpace = `${group} ${id}`;
+      register(twoPartColon);
+      register(twoPartSpace);
+      this.manifests.set(twoPartColon, cmd);
+      this.manifests.set(twoPartSpace, cmd);
+      const fullPath = `${group} ${subgroup} ${id}`;
+      this.pluginAliases.set(fullPath, canonicalId);
+      this.manifests.set(fullPath, cmd);
+      const colonPath = `${group}:${subgroup}:${id}`;
+      this.pluginAliases.set(colonPath, canonicalId);
+      this.manifests.set(colonPath, cmd);
+    } else if (group) {
+      const colonName = `${group}:${id}`;
+      const spaceName = `${group} ${id}`;
+      this.pluginAliases.set(colonName, canonicalId);
+      this.pluginAliases.set(spaceName, canonicalId);
+      this.manifests.set(colonName, cmd);
+      this.manifests.set(spaceName, cmd);
+    }
+    register(id);
+    for (const alias of cmd.manifest.aliases || []) {
+      if (!collisionAliases.has(alias)) {
+        register(alias);
+      }
+    }
+  }
+  /**
+   * Register synthetic subgroups for help display.
+   */
+  _registerSyntheticGroups(cmd, commandAdapter) {
+    const { id, group, subgroup } = cmd.manifest;
+    if (group && subgroup) {
+      const subgroupKey = `${group} ${subgroup}`;
+      if (!this.groups.has(subgroupKey)) {
+        this.groups.set(subgroupKey, {
+          name: subgroupKey,
+          describe: subgroup,
+          commands: []
+        });
+        this.byName.set(subgroupKey, this.groups.get(subgroupKey));
       }
+      this.groups.get(subgroupKey).commands.push(commandAdapter);
+      const twoPartSpace = `${group} ${id}`;
+      if (!this.byName.has(twoPartSpace)) {
+        this.byName.set(twoPartSpace, commandAdapter);
+      }
+      const twoPartColon = `${group}:${id}`;
+      if (!this.byName.has(twoPartColon)) {
+        this.byName.set(twoPartColon, commandAdapter);
+      }
+      const fullPath = `${group} ${subgroup} ${id}`;
+      this.byName.set(fullPath, commandAdapter);
+    } else if (group) {
+      const fullName = `${group} ${id}`;
+      const colonName = `${group}:${id}`;
+      this.byName.set(fullName, commandAdapter);
+      this.byName.set(colonName, commandAdapter);
+    }
+  }
+  // ─── Resolution ──────────────────────────────────────────────────────────
+  /**
+   * Resolve any user input to its canonical plugin ID.
+   *
+   * Returns canonicalId if found in plugin aliases, undefined otherwise.
+   */
+  resolveToCanonical(input) {
+    if (this.pluginAliases.has(input)) {
+      return this.pluginAliases.get(input);
+    }
+    const converted = input.includes(":") ? input.replace(/:/g, " ") : input.replace(/ /g, ":");
+    if (this.pluginAliases.has(converted)) {
+      return this.pluginAliases.get(converted);
     }
+    return void 0;
   }
+  // ─── Public API ──────────────────────────────────────────────────────────
   markPartial(partial) {
     this.partial = partial;
   }
@@ -1143,23 +1236,43 @@ var InMemoryRegistry = class {
   }
   listManifests() {
     const unique = /* @__PURE__ */ new Set();
-    for (const cmd of this.manifests.values()) {
+    for (const cmd of this.pluginByCanonical.values()) {
       unique.add(cmd);
     }
     return Array.from(unique);
   }
   has(name) {
-    return this.byName.has(name);
+    return this.byName.has(name) || this.pluginAliases.has(name);
   }
   /**
-   * Get command with type information for secure routing
+   * Get command with type information for secure routing.
    *
-   * Returns type='system' for commands from registerGroup() - execute in-process
-   * Returns type='plugin' for commands from registerManifest() - execute in subprocess
-   *
-   * This separation prevents malicious plugins from escaping the sandbox.
+   * System commands ALWAYS win — checked first before any plugin lookup.
+   * Returns type='system' for system commands (in-process execution).
+   * Returns type='plugin' for plugin commands (subprocess execution).
    */
   getWithType(nameOrPath) {
+    const normalized = typeof nameOrPath === "string" ? nameOrPath : nameOrPath.join(" ");
+    if (this.systemCommands.has(normalized)) {
+      return { cmd: this.systemCommands.get(normalized), type: "system" };
+    }
+    const colonVariant = normalized.replace(/ /g, ":");
+    if (this.systemCommands.has(colonVariant)) {
+      return { cmd: this.systemCommands.get(colonVariant), type: "system" };
+    }
+    if (this.groups.has(normalized)) {
+      return { cmd: this.groups.get(normalized), type: "system" };
+    }
+    const canonicalId = this.resolveToCanonical(normalized);
+    if (canonicalId) {
+      const pluginCmd = this.pluginByCanonical.get(canonicalId);
+      if (pluginCmd && !pluginCmd.shadowed) {
+        const cmd2 = this.byName.get(canonicalId) ?? this.byName.get(normalized);
+        if (cmd2) {
+          return { cmd: cmd2, type: "plugin" };
+        }
+      }
+    }
     const cmd = this.get(nameOrPath);
     if (!cmd) {
       return void 0;
@@ -1167,18 +1280,11 @@ var InMemoryRegistry = class {
     if ("commands" in cmd) {
       return { cmd, type: "system" };
     }
-    const normalizedName = typeof nameOrPath === "string" ? nameOrPath : nameOrPath.join(" ");
-    if (this.systemCommands.has(normalizedName)) {
+    if (this.systemCommands.has(normalized) || this.systemCommands.has(colonVariant)) {
       return { cmd, type: "system" };
     }
-    if (normalizedName.includes(":")) {
-      const spaceVersion = normalizedName.replace(":", " ");
-      if (this.systemCommands.has(spaceVersion)) {
-        return { cmd, type: "system" };
-      }
-    }
-    const manifestCmd = this.getManifestCommand(normalizedName);
-    if (manifestCmd) {
+    const manifestCmd = this.getManifestCommand(normalized);
+    if (manifestCmd && !manifestCmd.shadowed) {
       return { cmd, type: "plugin" };
     }
     return { cmd, type: "system" };
@@ -1189,15 +1295,15 @@ var InMemoryRegistry = class {
         return this.byName.get(nameOrPath);
       }
       if (nameOrPath.includes(":")) {
+        const spaceKey = nameOrPath.replace(/:/g, " ");
+        if (this.byName.has(spaceKey)) {
+          return this.byName.get(spaceKey);
+        }
         const parts = nameOrPath.split(":");
         if (parts.length === 2) {
-          const exactMatch = this.byName.get(nameOrPath);
-          if (exactMatch) {
-            return exactMatch;
-          }
-          const spaceKey = parts.join(" ");
-          if (this.byName.has(spaceKey)) {
-            return this.byName.get(spaceKey);
+          const spaceKey2 = parts.join(" ");
+          if (this.byName.has(spaceKey2)) {
+            return this.byName.get(spaceKey2);
           }
         }
       }
@@ -1288,7 +1394,11 @@ var InMemoryRegistry = class {
     if (this.manifests.has(idOrAlias)) {
       return this.manifests.get(idOrAlias);
     }
-    for (const cmd of this.manifests.values()) {
+    const canonicalId = this.resolveToCanonical(idOrAlias);
+    if (canonicalId) {
+      return this.pluginByCanonical.get(canonicalId);
+    }
+    for (const cmd of this.pluginByCanonical.values()) {
       if (cmd.manifest.aliases?.includes(idOrAlias)) {
         return cmd;
       }
@@ -3654,23 +3764,24 @@ async function registerManifests(discoveryResults, registry2, options = {}) {
         } catch (hookError) {
           log3.debug(`Lifecycle hooks unavailable for ${manifest.id}: ${hookError.message}`);
         }
-        const existing = globalIds.get(manifest.id);
+        const canonicalKey = manifest.group ? `${manifest.group}:${manifest.id}` : manifest.id;
+        const existing = globalIds.get(canonicalKey);
         if (existing) {
           const collision = checkCollision(manifest, existing, result.source, namespace);
           if (collision.shouldShadow) {
             existing.shadowed = true;
-            globalIds.set(manifest.id, cmd);
+            globalIds.set(canonicalKey, cmd);
             if (logLevel === "info" || logLevel === "debug") {
-              log3.info(`${manifest.id} from ${result.source} shadows ${existing.source} version`);
+              log3.info(`${canonicalKey} from ${result.source} shadows ${existing.source} version`);
             }
           } else {
             cmd.shadowed = true;
             if (logLevel === "info" || logLevel === "debug") {
-              log3.info(`${manifest.id} from ${result.source} shadowed by ${existing.source} version`);
+              log3.info(`${canonicalKey} from ${result.source} shadowed by ${existing.source} version`);
             }
           }
         } else {
-          globalIds.set(manifest.id, cmd);
+          globalIds.set(canonicalKey, cmd);
         }
         const aliasesToCheck = manifest.aliases || [];
         for (const alias of aliasesToCheck) {